> ## Documentation index
> Fetch the complete documentation index at: https://dash.robopost.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

Every request carries one of your team's API keys. The key is the only credential the API needs: there is
no OAuth flow, no token to refresh, and it works from any server.

**You need:** to be a member of the team. Keys are listed for the whole team under **Manage API Keys**.

## Create a key

1. Open **Team** (under **Account** in the sidebar) and click **Manage API Keys**.
2. Click **New API Key**, enter a **Name** that says where it will be used, and click **Create API Key**.
3. Click **Copy Key** and store it in your secret manager or environment, not in your code.

Create one key per integration, so you can revoke one without breaking the others.

## Send the key

Put it in the `Authorization` header:

```bash
curl https://public-api.robopost.app/v1/channels \
  -H "Authorization: Bearer $ROBOPOST_API_KEY"
```

```python
import os, requests

api = requests.Session()
api.headers["Authorization"] = f"Bearer {os.environ['ROBOPOST_API_KEY']}"
channels = api.get("https://public-api.robopost.app/v1/channels").json()
```

```javascript
const res = await fetch("https://public-api.robopost.app/v1/channels", {
  headers: { Authorization: `Bearer ${env.ROBOPOST_API_KEY}` },
});
```

The API also accepts `X-API-Key: <key>`, and, for older integrations, `?apikey=<key>` in the query string.
Prefer a header: query strings end up in server logs and browser history.

## What a key can do

- A key belongs to one team and can do everything the API offers on that team: read and change its posts,
  channels, media, inbox and analytics. There are no read-only keys yet; give a key only to systems you trust.
- Deleting a post through the API records which key did it (`deleted_by: "api_key:<id>"`).
- Keys don't expire. They stop working when you delete them.
- Analytics and the social inbox need a plan that includes them, exactly as in the dashboard.

## Rotate or revoke a key

To replace a key without downtime: create a new key, deploy it, then delete the old one. In **Manage API
Keys**, open the key and click **Delete**. Requests with a deleted key get `401` immediately.

## If you get 401

| Response | Meaning |
| --- | --- |
| `401` "API key is required." | No key was sent. Check the header name and the `Bearer ` prefix |
| `401` "Invalid API key." | The key is wrong or was deleted |
| `404` "Team not found." | The key's team was deleted |

> **Important:** never send an API key to support or paste it into a ticket. Support never needs it.

## Next

[Create posts](https://dash.robopost.app/docs/api/create-posts.md)