API keys and authentication

An API key lets your own code, the Posty5 SDKs, n8n and AI assistants work with your Posty5 account. This page explains how keys work, and the other developer pages link here instead of repeating it.

Get a Developer account

API keys are a Developer account feature. Upgrading is free and takes effect at once. It does not change your plan or your credits.

In the Posty5 dashboard, open Account settings and choose API Keys.
Choose Upgrade to Developer. The page reloads with your API keys and the ways to connect to Posty5.

Open API Keys in the dashboard

Create a key

In API Keys, choose Create API key.
Give the key a name that says where it is used, for example Website contact form. The name is only for you.
Choose its record scope (explained below) and choose Create. The new key appears with a copy button.

A key is not shown only once. The list shows every key masked, and its copy button copies the whole key again whenever you need it. Rename a key or change its record scope from its actions in the list.

Send the key with every request

Send the key in this header of every request to the Posty5 API — X-API-Key

The API lives at https://api.posty5.com

To check a key, call the route that describes it. It answers with the key, its owner, the plan and the credits the account can spend. A revoked or unknown key gets 401.

curl https://api.posty5.com/api/api-key/current \
  -H "X-API-Key: YOUR_API_KEY"

The SDKs and the n8n nodes take the same key.

Client	Where the key goes	Read more
JavaScript / TypeScript	`new HttpClient({ apiKey: "YOUR_API_KEY" })`	npm-sdk
.NET	`new Posty5Options { ApiKey = "YOUR_API_KEY" }`	dotnet-sdk
n8n	The Posty5 API credential, in its API Key field	n8n-nodes

Choose what a key can see

Every key has a record scope. It decides which of your records the key can list and edit.

Record scope	What the key can list and edit
Only records made with this key	Only the records this key created. Records you made in the dashboard or with another key stay out of its reach, so two integrations never touch each other’s work.
All my account	Every record in your account, wherever it was created. An AI assistant usually needs this, because you ask it about things you made yourself.

A new key starts on Only records made with this key, and so does every key created before this setting existed. To change it, open the key’s actions and choose Change record scope. A key’s MCP link uses the key’s record scope.

Last used, and revoking a key

The Last used column shows when the key last made a request. It is updated at most once every few minutes, so a key in constant use can look a few minutes behind.

To revoke a key, open its actions in the list, choose Revoke and confirm.

It stops working at once. Every app, script and integration that uses it gets 401 on its next request.
Its AI assistant (MCP) link stops at the same moment.
Revoking cannot be undone. Create a new key if you need one again.
What the key already did stays. The records it created remain in your account, and posts it scheduled still publish on time, because scheduled publishing does not use the key.

Credits

A call made with an API key costs exactly what the same action costs in the dashboard, and the credits come from the account that owns the key. The price of every action is listed on Feature Credits

Keep keys safe

Keep keys on a server. Never put one in a web page, a mobile app or a public repository — anyone who reads it can act as you.
A key cannot manage keys. Creating, listing, renaming and revoking keys works only while you are signed in to Posty5, so a leaked key cannot read your other keys or make new ones.
To rotate a key, create a new one, move your integration to it, check that the new key’s Last used date moves, then revoke the old key.
If a key leaks, revoke it straight away and create a new one.