Authentication
API keys for the Onepostly API.
Every request needs a workspace API key. Create one in Dashboard → Settings → API keys. The full key is shown only once at creation.
Set Up The Client
Pass the key to the SDK's Configuration; read it from the ONEPOSTLY_API_KEY environment variable so the key never appears in your code.
import { Configuration } from "@onepostly/sdk";
// Pass this to every API class: new PostsApi(config), new MediaApi(config), …
const config = new Configuration({
apiKey: process.env.ONEPOSTLY_API_KEY, // sent as the `x-api-key` header
});Send The Key Manually
Raw HTTP requests authenticate with one of two headers.
x-api-key: op_YOUR_KEYOr as a bearer token:
Authorization: Bearer op_YOUR_KEYKey Permissions
| Permission | Access |
|---|---|
read_write (default) | Full API |
read_only | Read routes only. Writes return 403 FORBIDDEN |
Keys are scoped to their workspace: they can only reach that workspace's connected accounts, posts, media, and webhooks.
Errors
| Code | HTTP | Cause | Fix |
|---|---|---|---|
UNAUTHORIZED | 401 | Key missing, invalid, or revoked | Check the header value and that the key still exists in the dashboard |
FORBIDDEN | 403 | Read-only key used on a write route | Use a read_write key |
Both surface as ResponseError in TypeScript (error.response.status, await error.response.json()) and ApiException in Python (error.status, error.body). Treat keys like passwords: keep them out of client-side code and version control. To rotate a key, create a new one and delete the old.
Next: Connect accounts to get your accountId values.