Authentication

The REST API uses API keys for authentication. Every request must include a valid key in the Authorization header as a Bearer token.

Create an API key

Generate keys in the app under Settings → API Keys. Each key has:

• A name (so you can tell keys apart and revoke the right one later).
• An optional expiry date.
• An isActive flag you can toggle without deleting the key.

The full key value is shown once at creation time. Store it securely — post.buzz keeps only a SHA-256 hash of the key, so it can't be recovered if lost. See Managing API keys.

Use the key

Pass the key in the Authorization header:

curl https://<your-api-origin>/api/v1/posts \
  -H "Authorization: Bearer gx_live_YOUR_API_KEY"

const res = await fetch("https://<your-api-origin>/api/v1/posts", {
  headers: { Authorization: `Bearer ${process.env.POSTBUZZ_API_KEY}` },
});

How keys are validated

On each /v1/* request, post.buzz:

1. Reads the Authorization: Bearer <token> header.
2. Hashes the token with SHA-256.
3. Looks up an active API key with a matching hash.
4. Rejects if not found, inactive, or expired.

The authenticated key's userId becomes the request identity — every resource you read or write is scoped to that user, exactly as if they were acting in the app. There's no way for a key to reach another user's data.

Errors

Status	When
401	Missing Authorization header
401	Invalid API key — no active key matches the hash
401	API key expired — the key's expiresAt is in the past

See Errors for the full table.

Security notes

• Keys are scoped to a user, not an organization. Resources are gated on userId.
• Treat keys like passwords. Use environment variables, rotate periodically, and revoke keys you no longer need.
• lastUsedAt is updated on each request so you can spot dormant keys.