Authentication

The REST API uses API keys for authentication. Every request must include a valid key in the Authorization header as a Bearer token.

Create an API key

Generate keys in the app under Settings → API Keys (see Managing API keys). Each key has:

• A name (up to 100 characters, so you can tell keys apart later).
• An optional expiry date (must be in the future).

The raw key is generated server-side — 32 random bytes rendered as a sx_live_-prefixed string — and returned exactly once at creation time. Store it securely: post.buzz persists only a SHA-256 hash of the key (plus a short key prefix for identification), so the full value cannot be recovered if lost.

warning

If you lose a key, the only recourse is to revoke it and create a new one.

Key lifecycle

There is no edit or enable/disable operation. A key is either usable or it isn't:

Action	Effect
revoke	Marks the key inactive. It immediately fails with 401.
delete	Removes the key row entirely.

Revoking or deleting is done in Settings → API Keys. The key list shows each key's id, name, keyPrefix, lastUsedAt, and creation date — never the full key.

Use the key

Pass the key in the Authorization header:

curl https://<your-api-origin>/api/v1/posts \
  -H "Authorization: Bearer sx_live_YOUR_API_KEY"

const res = await fetch("https://<your-api-origin>/api/v1/posts", {
  headers: { Authorization: `Bearer ${process.env.POSTBUZZ_API_KEY}` },
});

How keys are validated

On each /v1/* request, post.buzz:

1. Reads the Authorization: Bearer <token> header.
2. Hashes the token with SHA-256.
3. Looks up an active API key row with a matching hash.
4. Rejects if not found, inactive, or expired.

Scoping

Keys are scoped to an organization, not to an individual user. Every key row carries the organization that was billing-active when it was created, and REST handlers resolve that organization's billing reference — resources are gated on the organization (its posts, its connected accounts), not on the individual user who happened to hold the key. A key can never reach data outside its organization; use teams and organizations to partition access within one.

Subscription requirement

Every /v1/* call passes a hard subscription gate: the key's organization must have an active or trialing subscription. Without one, every call — even a simple list — returns:

{
  "error": {
    "code": "subscription_required",
    "message": "An active subscription is required. Choose a plan to continue."
  }
}

See Plans. Paid plans include a 7-day trial.

Errors

Status	Body	When
401	{ "error": "Missing API key" }	No Authorization header
401	{ "error": "Invalid API key" }	No active key matches the hash
401	{ "error": "API key expired" }	The key's expiresAt is in the past

See Errors for the full table.

Security notes

• Treat keys like passwords. Use environment variables, rotate periodically, and revoke keys you no longer need.
• lastUsedAt is updated on each request so you can spot dormant keys.
• The only rate limits in the system are described in Limits — there is no per-key request rate limit.