Authentication
How to authenticate with the PowerPost API using API keys.
All API requests require authentication via an API key.
Getting an API Key
- Log in to your PowerPost dashboard
- Navigate to Settings → API
- Click Create API Key
- Give it a name and copy the key
Using Your API Key
Include your key in the x-api-key header:
curl https://powerpost.ai/api/v1/account/credits \
-H "x-api-key: pp_live_sk_YOUR_KEY_HERE"Or use Authorization: Bearer:
curl https://powerpost.ai/api/v1/account/credits \
-H "Authorization: Bearer pp_live_sk_YOUR_KEY_HERE"Key Format
PowerPost API keys follow this format:
pp_live_sk_{random_string}pp— PowerPost prefixlive— Production key (test keys may be added later)sk— Secret key{random}— Unique identifier
Permissions (Scopes)
Each API key carries a set of scopes — resource:action permissions that
control exactly what the key can do. You pick the scopes when you create the key.
Every endpoint requires one scope; a request made with a key that lacks it returns
403 INSUFFICIENT_SCOPE, and the response names the missing scope.
Available scopes
| Scope | Grants |
|---|---|
account:read | Read the credit balance |
content:read | List and read caption generations |
content:generate | Generate captions — spends credits |
images:read | Read image generations |
images:generate | Generate images — spends credits |
videos:read | Read video generations |
videos:generate | Generate videos — spends credits |
media:write | Upload media files |
posts:read | List and read posts |
posts:write | Create posts |
posts:publish | Publish, schedule, and cancel posts |
calendar:read | Read calendar entries |
calendar:write | Create and edit calendar entries |
analytics:read | Read post analytics |
The *:generate scopes spend credits on every call. Only grant them to keys
that need to create content.
Presets
The key-creation dialog has three one-click presets:
- Full access — every scope, including
posts:publish. - Draft only — every scope except
posts:publish. Prepare content without the risk of publishing. - Read only — the
*:readscopes. No generation, no writes.
Tick individual scopes for anything in between.
Scopes are set at creation and cannot be changed. To adjust a key's permissions, revoke it and create a new one.
Workspace Scoping
All content endpoints require an X-Workspace-Id header to specify which workspace the request targets. See Workspaces for full details on workspace scoping, finding your workspace ID, and which endpoints require it.
Requirements
API access is available to all authenticated users with a valid API key. Credits are required for content generation and publishing.
Key Management
- Maximum keys: 10 per account
- Scopes: chosen at creation from the table above; immutable afterwards
- Revocation: revoke compromised keys immediately in Settings
- Last used: track when each key was last used
Security Best Practices
- Never commit keys to source control — Use environment variables
- Rotate keys periodically — Create new keys and revoke old ones
- Use separate keys for different environments or services
- Monitor usage — Check the dashboard for unexpected activity