Skip to main content

Managing API keys

API keys authenticate requests to the REST API. Manage them from Settings → API Keys. This page covers the day-to-day lifecycle; for how keys are validated, see Authentication.

Create a key​

  1. Go to Settings → API Keys and choose Create key.
  2. Give it a name that describes its purpose (e.g. "CI publish script," "Zapier integration"). Naming helps you identify and revoke the right key later.
  3. Optionally set an expiry date.
  4. Copy the key value immediately — it's shown only once.

post.buzz stores only a SHA-256 hash of each key, so if you lose the value you must create a new key. There's no way to recover it.

Use the key​

Store the key in an environment variable or secret manager — never in code that's committed to version control.

export POSTBUZZ_API_KEY="gx_live_..."
curl https://<your-api-origin>/api/v1/posts \
  -H "Authorization: Bearer $POSTBUZZ_API_KEY"

Rotate a key​

To rotate (replace) a key without downtime:

  1. Create a new key.
  2. Update your integration to use the new key.
  3. Once confirmed working, revoke the old key (or set isActive: false).

Deactivate vs. delete​

  • Deactivate (toggle isActive off) — keeps the key record but blocks all requests. Useful for temporary suspension while you investigate.
  • Delete — removes the key entirely. Use when you're sure it's no longer needed.

Monitoring usage​

Each key records a lastUsedAt timestamp, updated on every request. Review it periodically to spot dormant keys (good rotation candidates) or unexpected activity.

Scope and safety​

  • Keys are scoped to your user. They can act on any account you can access — including accounts shared with you via an organization.
  • A key can't reach another user's data.
  • Treat keys like passwords. Rotate them, scope them narrowly, and revoke any you no longer use.