Authentication

Every request carries one of your team's API keys. The key is the only credential the API needs: there is no OAuth flow, no token to refresh, and it works from any server.

You need: to be a member of the team. Keys are listed for the whole team under Manage API Keys.

Create a key

1. Open Team (under Account in the sidebar) and click Manage API Keys.
2. Click New API Key, enter a Name that says where it will be used, and click Create API Key.
3. Click Copy Key and store it in your secret manager or environment, not in your code.

Create one key per integration, so you can revoke one without breaking the others.

Send the key

Put it in the Authorization header:

curl https://public-api.robopost.app/v1/channels \
  -H "Authorization: Bearer $ROBOPOST_API_KEY"

import os, requests

api = requests.Session()
api.headers["Authorization"] = f"Bearer {os.environ['ROBOPOST_API_KEY']}"
channels = api.get("https://public-api.robopost.app/v1/channels").json()

const res = await fetch("https://public-api.robopost.app/v1/channels", {
  headers: { Authorization: `Bearer ${env.ROBOPOST_API_KEY}` },
});

The API also accepts X-API-Key: <key>, and, for older integrations, ?apikey=<key> in the query string. Prefer a header: query strings end up in server logs and browser history.

What a key can do

• A key belongs to one team and can do everything the API offers on that team: read and change its posts, channels, media, inbox and analytics. There are no read-only keys yet; give a key only to systems you trust.
• Deleting a post through the API records which key did it (deleted_by: "api_key:<id>").
• Keys don't expire. They stop working when you delete them.
• Analytics and the social inbox need a plan that includes them, exactly as in the dashboard.

Rotate or revoke a key

To replace a key without downtime: create a new key, deploy it, then delete the old one. In Manage API Keys, open the key and click Delete. Requests with a deleted key get 401 immediately.

If you get 401

Next

Create posts