Authentication
The PostEverywhere API uses Bearer token authentication. Every request must include an API key in the Authorization header. Keys are scoped, revocable, and included on all plans.
How it works
Authentication is handled via the Authorization HTTP header with a Bearer token. Include this header in every API request to https://app.posteverywhere.ai/api/v1.
Authorization: Bearer pe_live_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4API key format
All PostEverywhere API keys follow a consistent format that makes them easy to identify in your codebase and configure with secret scanning tools like GitHub's or GitGuardian.
Key structure
Regex pattern: Use pe_live_[a-f0-9]{32} to scan for accidentally committed keys in your CI/CD pipeline or pre-commit hooks.
Generating a key
API keys are created from the PostEverywhere dashboard. You can create up to 10 keys per organization, each with independent names and scopes.
Open Settings
Sign in to app.posteverywhere.ai and navigate to Settings > Developer.
Click "Create API Key"
Opens the key creation dialog.
Name your key
Give it a descriptive name like "Production Backend" or "Analytics Dashboard". This helps you identify keys later.
Select scopes
Choose Read (list/view resources), Write (create/edit/delete resources), or both. You can always create another key with different scopes.
Copy the key
Your key is displayed once. Copy it immediately and store it securely. You cannot retrieve it later.
Scopes
Each API key has one or more scopes that control what operations it can perform. Use the principle of least privilege — if a service only reads data, give it a Read-only key.
| Scope | Permissions | Example use case |
|---|---|---|
| Read | List and view accounts, posts, media, and results | Analytics dashboard, monitoring |
| Write | Create, edit, delete, and retry posts; upload and delete media | Automation backend, CMS integration |
| AI | Generate AI images | AI content pipeline, image generation |
Scope access by endpoint
| Endpoint | Read | Write | AI |
|---|---|---|---|
GET/accounts | |||
GET/accounts/{id} | |||
POST/posts | |||
GET/posts | |||
GET/posts/{id} | |||
PATCH/posts/{id} | |||
DELETE/posts/{id} | |||
GET/posts/{id}/results | |||
POST/posts/{id}/retry | |||
POST/media/upload | |||
GET/media | |||
GET/media/{id} | |||
DELETE/media/{id} | |||
POST/ai/generate-image |
Using your key
Pass your API key in the Authorization header as a Bearer token. Here are examples in the most popular languages.
cURL
curl https://app.posteverywhere.ai/api/v1/accounts \
-H "Authorization: Bearer $POSTEVERYWHERE_API_KEY"Python
import os
import requests
API_KEY = os.environ["POSTEVERYWHERE_API_KEY"]
BASE_URL = "https://app.posteverywhere.ai/api/v1"
response = requests.get(
f"{BASE_URL}/accounts",
headers={"Authorization": f"Bearer {API_KEY}"}
)
data = response.json()
for account in data["data"]:
print(f"{account['platform']}: {account['name']} ({account['health']})")Node.js
const API_KEY = process.env.POSTEVERYWHERE_API_KEY;
const BASE_URL = "https://app.posteverywhere.ai/api/v1";
const response = await fetch(`${BASE_URL}/accounts`, {
headers: {
"Authorization": `Bearer ${API_KEY}`,
},
});
const { data } = await response.json();
data.forEach((account) => {
console.log(`${account.platform}: ${account.name} (${account.health})`);
});The API works with any HTTP client in any language. See the SDKs & Libraries page for more language examples and our OpenAPI spec for auto-generating clients.
Security best practices
Your API key grants access to your PostEverywhere organization. Treat it like a password. Follow these practices to keep your integration secure.
Store keys in environment variables
Never hardcode API keys in your source code. Use environment variables (POSTEVERYWHERE_API_KEY), secret managers (AWS Secrets Manager, Vault), or encrypted config files.
Never commit keys to version control
Add your .env file to .gitignore. Enable GitHub secret scanning or GitGuardian to detect accidentally committed keys. Use the regex pe_live_[a-f0-9]{32} for custom rules.
Rotate keys periodically
Create a new key, update your applications, then revoke the old one. We recommend rotating every 90 days. Since you can have up to 10 keys, you can overlap old and new keys during migration.
Use the principle of least privilege
If a service only reads data (dashboards, analytics), give it a Read-only key. Reserve Write-scoped keys for services that actually create or modify posts. Only enable the AI scope if your integration needs AI image generation. This limits blast radius if a key is compromised.
Monitor key usage
Track rate limit headers (X-RateLimit-Remaining) in your responses to detect unusual activity. Unexpected spikes in API usage may indicate a compromised key.
# .env — never commit this file
POSTEVERYWHERE_API_KEY=pe_live_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4.env
.env.local
.env.productionRevoking keys
You can revoke any API key instantly from the PostEverywhere dashboard. Revocation takes effect immediately — any in-flight or future requests using the revoked key will receive a 401 Unauthorized response.
- Go to Settings > Developer
- Find the key you want to revoke in the key list
- Click the Revoke button next to the key
- Confirm the revocation
Warning: Revoking a key is permanent and cannot be undone. Any application using the revoked key will immediately lose access. Make sure to update your applications with a new key before revoking the old one during key rotation.
Error responses
When authentication fails, the API returns a 401 Unauthorized response. The error follows the standard PostEverywhere error response format.
401 — Missing or invalid API key
{
"data": null,
"error": {
"code": "unauthorized",
"message": "Invalid or missing API key. Include a valid key in the Authorization header.",
"status": 401
},
"meta": {
"request_id": "req_err123abc456",
"timestamp": "2026-03-02T10:00:00Z"
}
}403 — Insufficient scopes
{
"data": null,
"error": {
"code": "forbidden",
"message": "This API key does not have the 'write' scope required for POST /posts. Create a new key with Write scope.",
"status": 403
},
"meta": {
"request_id": "req_err789def012",
"timestamp": "2026-03-02T10:00:00Z"
}
}Common authentication issues
| Error | Cause | Fix |
|---|---|---|
| 401 | No Authorization header | Add -H "Authorization: Bearer pe_live_..." |
| 401 | Typo in "Bearer" prefix | Ensure the header value starts with exactly Bearer (capital B, one space) |
| 401 | Key has been revoked | Generate a new key from Settings > Developer |
| 403 | Missing required scope | Create a new key with the appropriate scope (Read or Write) |
Related pages
Quick Start Guide
Make your first API call in 5 minutes with step-by-step examples.
Rate Limits & Errors
Rate limit windows, error codes, and retry strategies.
Posts API
Create, schedule, update, and delete posts across 7 platforms.
Social Media Scheduler
Schedule and automate posts with the PostEverywhere dashboard.
Instagram Scheduler
Automate Instagram posts, Reels, Stories, and carousels.
Pricing
API access included on all plans from $19/mo.
Get your API key
API access is included on every PostEverywhere plan. Generate a key in seconds and start automating your social media scheduling.