# PostEverywhere Authentication Guide

> How to authenticate with the PostEverywhere API using Bearer tokens. Generate API keys, manage scopes, and secure your integration.

**Source:** https://posteverywhere.ai/docs/authentication
**Section:** Getting started
**API reference:** https://posteverywhere.ai/docs/api/reference

---

All API requests require a Bearer token in the `Authorization` header. If you have not set up your account yet, start with the [Quick Start guide](/docs/quick-start).

## Create an API key in the dashboard
1. Sign in to [PostEverywhere](https://app.posteverywhere.ai)
2. Go to the [**Developers** page](https://app.posteverywhere.ai/developers) and open the **API Keys** tab
3. Click **Create a key** and choose its scopes
4. Copy your key (it starts with `pe_live_`)

> **Keep Your Key Secret**
>
> Your API key grants the scopes it was created with (`read`, `write`, `ai`), optionally restricted to specific social accounts. Never expose it in client-side code, public repositories, or browser requests.

## Send your key with every request
Include the key in every request:

```bash
curl https://app.posteverywhere.ai/api/v1/accounts \
  -H "Authorization: Bearer pe_live_abc123def456..."
```

Or with the Node.js SDK:

```javascript
import { PostEverywhere } from '@posteverywhere/sdk';

const client = new PostEverywhere({
  apiKey: process.env.POSTEVERYWHERE_API_KEY,
});
```

## What a successful authenticated response looks like
All responses follow a consistent envelope:

```json
{
  "data": { },
  "error": null,
  "meta": {
    "request_id": "a1b2c3d4",
    "timestamp": "2026-04-01T10:00:00Z"
  }
}
```

On error:

```json
{
  "data": null,
  "error": {
    "code": "invalid_api_key",
    "message": "Invalid or expired API key"
  },
  "meta": {
    "timestamp": "2026-04-01T10:00:00Z"
  }
}
```

Authentication failures come from the auth layer, so they omit `retryable`, `details` and `meta.request_id`. A request with no `Authorization` header at all returns a plain-text `401 Unauthorized`.

All timestamps in responses are UTC. The `meta.request_id` value is what support will ask for if you need to debug a failed call, so log it.

## Authentication errors and what causes them
| Status | Code | Description |
|--------|------|-------------|
| `400` | `validation_error`, `invalid_json`, `invalid_id`, … | Invalid request body or parameters; each case has its own code, see [Errors](/docs/errors) |
| `401` | `invalid_api_key`, `api_key_revoked`, `api_key_expired` | Missing or invalid API key |
| `404` | `not_found` | Resource doesn't exist |
| `429` | `rate_limit_exceeded` | Too many requests (see [Rate Limits](/docs/rate-limits)) |
| `500` | `internal_error` | Server error: retry with backoff |

## Where to go after your first authenticated call
Once your API key is set up, explore the platform guides and API reference:

- **[Create your first post](/docs/api/create-post)** -- schedule content to any platform
- **[Upload media](/docs/api/init-media-upload)** -- attach images and videos to your posts
- **[Rate Limits](/docs/rate-limits)** -- understand request quotas and best practices
- **Platform guides:** [Instagram](/docs/platforms/instagram) | [TikTok](/docs/platforms/tiktok) | [YouTube](/docs/platforms/youtube) | [LinkedIn](/docs/platforms/linkedin) | [X (Twitter)](/docs/platforms/x-twitter) | [Facebook](/docs/platforms/facebook) | [Threads](/docs/platforms/threads) | [Pinterest](/docs/platforms/pinterest)

**Related:** [API key scopes](/docs/scopes) · [check your key and quota with /v1/me](/docs/introspection) · [testing your integration](/docs/testing) · [social media OAuth explained](/blog/social-media-oauth-guide) · [getting API access to each network](/blog/how-to-get-social-media-api-access)