Authentication
Send a Postel API key as a bearer token; the key decides which workspace every request acts for.
Every request needs an API key in the Authorization header:
Authorization: Bearer pstl_...Call https://www.postel.app/api directly. A request to postel.app without www gets redirected, and HTTP clients drop the Authorization header on that redirect, so the API never sees your key.
Create a key
- In Postel, open Settings → API & MCP. Only workspace owners and admins see this page.
- Click Create API key and give it a name.
- Copy the key. Postel shows it once.
To revoke a key, delete it on the same page. Requests with it fail right away.
What a key can do
A key belongs to the person who created it and to one workspace, the one you were in when you created it. Every request acts as that person in that workspace. Posts you create show up in that workspace in Postel, and the workspace's plan, AI credits and approval settings apply.
If the person who created the key leaves the workspace, the key stops working. Create a new key from an account that is still a member.
The same keys work for the MCP server.
Keep keys on your server. Don't ship one in a browser app or a mobile app, where anyone can read it.
Check a key
GET /v1/me is the cheapest way to test a key. Automation tools use it as their connection test.
| Field | Type | Description |
|---|---|---|
user.id | string | The person the key belongs to. |
user.name | string | Their name. |
user.email | string | Their email. |
workspace.id | string | The workspace the key acts for. |
workspace.name | string | Its name. |
workspace.slug | string or null | Its slug in Postel URLs. |
workspace.timezone | string | IANA timezone, like Europe/Berlin. |
canPublish | boolean | true when the plan includes scheduling and publishing. |
label | string | A name to show for this connection, like Northwind (maya@northwind.studio). |
Wrong or missing key
A missing, malformed or revoked key gets 401:
{
"error": "This API key isn't valid. Create one in Postel under Settings → API keys and paste it in.",
"code": "invalid_api_key"
}Identify your client
You can send an optional X-Postel-Client header with your app's name and version:
X-Postel-Client: my-crm-sync/1.4.0Postel's own Zapier, n8n and Make apps send it, so posts they create show where they came from. Sending it is safe for any client and never changes how a request behaves.