Authentication

API keys for the Onepostly API.

Every request needs a workspace API key. Create one in Dashboard → Settings → API keys. The full key is shown only once at creation.

Set Up The Client

Pass the key to the SDK's Configuration; read it from the ONEPOSTLY_API_KEY environment variable so the key never appears in your code.

import { Configuration } from "@onepostly/sdk";

// Pass this to every API class: new PostsApi(config), new MediaApi(config), …
const config = new Configuration({
  apiKey: process.env.ONEPOSTLY_API_KEY, // sent as the `x-api-key` header
});

Send The Key Manually

Raw HTTP requests authenticate with one of two headers.

x-api-key: op_YOUR_KEY

Or as a bearer token:

Authorization: Bearer op_YOUR_KEY

Key Permissions

PermissionAccess
read_write (default)Full API
read_onlyRead routes only. Writes return 403 FORBIDDEN

Keys are scoped to their workspace: they can only reach that workspace's connected accounts, posts, media, and webhooks.

Errors

CodeHTTPCauseFix
UNAUTHORIZED401Key missing, invalid, or revokedCheck the header value and that the key still exists in the dashboard
FORBIDDEN403Read-only key used on a write routeUse a read_write key

Both surface as ResponseError in TypeScript (error.response.status, await error.response.json()) and ApiException in Python (error.status, error.body). Treat keys like passwords: keep them out of client-side code and version control. To rotate a key, create a new one and delete the old.

Next: Connect accounts to get your accountId values.