Skip to main content

Managing API keys

API keys authenticate requests to the REST API. Manage them from Settings → API Keys. This page covers the day-to-day lifecycle; for how keys are validated, see Authentication.

Create a key​

  1. Go to Settings → API Keys and choose Create key.
  2. Give it a name that describes its purpose (e.g. "CI publish script," "Zapier integration"). Naming helps you identify and revoke the right key later.
  3. Copy the key value immediately — it's shown only once.

Key values look like sx_live_<uuid> and are random; post.buzz stores only a SHA-256 hash of each key, so if you lose the value you must create a new key. There's no way to recover it.

Use the key​

Store the key in an environment variable or secret manager — never in code that's committed to version control.

export POSTBUZZ_API_KEY="sx_live_..."
curl https://post.buzz/api/v1/posts \
  -H "Authorization: Bearer $POSTBUZZ_API_KEY"

Rotate a key​

To rotate (replace) a key without downtime:

  1. Create a new key.
  2. Update your integration to use the new key.
  3. Once confirmed working, revoke the old key.

Revoke vs. delete​

  • Revoke — marks the key inactive; all requests with it are rejected from that moment. Useful for temporary suspension while you investigate.
  • Delete — removes the key record entirely. Use when you're sure it's no longer needed.

Monitoring usage​

Each key records a lastUsedAt timestamp, updated on every request, plus its creation date and a masked prefix. Review periodically to spot dormant keys (good rotation candidates) or unexpected activity.

Scope and safety​

  • A key belongs to your organization and can act on everything in it — including every team and account. It can't reach another organization's data.
  • Keys have no sub-scopes: treat each key as full access, and put narrow integrations in a narrow org (see Organizations).
  • Every request also requires an active or trialing subscription — a lapsed plan returns 403 subscription_required.
  • Treat keys like passwords. Rotate them and revoke any you no longer use.