Authentication

All PostSyncer API requests require authentication using an API key. This guide explains how to obtain and use your API key.

Don’t have an API key yet? Get one here.

Getting Your API Key

Sign in to your PostSyncer account at app.postsyncer.com
Navigate to Settings → API Integration
Click “Create”
Copy the key immediately - it won’t be shown again

Keep your API key secure and never share it publicly. If your key is compromised, regenerate it immediately.

Using Your API Key

Include your API key in the Authorization header of all requests:

Authorization: Bearer YOUR_API_KEY

Example Request

curl -X GET "https://postsyncer.com/api/v1/workspaces" \
  -H "Authorization: Bearer 11|HzNfjB..." \
  -H "Content-Type: application/json"

JavaScript Example

const response = await fetch('https://postsyncer.com/api/v1/workspaces', {
  headers: {
    'Authorization': 'Bearer 11|HzNfjB...',
    'Content-Type': 'application/json'
  }
});

Python Example

import requests

headers = {
    'Authorization': 'Bearer 11|HzNfjB...',
    'Content-Type': 'application/json'
}

response = requests.get('https://postsyncer.com/api/v1/workspaces', headers=headers)

Python Example

import requests

headers = {
    'Authorization': 'Bearer 11|HzNfjB...',
    'Content-Type': 'application/json'
}

response = requests.get('https://postsyncer.com/api/v1/workspaces', headers=headers)

PHP Example

$headers = [
    'Authorization: Bearer 11|HzNfjB...',
    'Content-Type: application/json',
];

$ch = curl_init('https://postsyncer.com/api/v1/workspaces');

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

$response = curl_exec($ch);

if (curl_errno($ch)) {
    echo 'Error: ' . curl_error($ch);
} else {
    $data = json_decode($response, true);
    print_r($data);
}

curl_close($ch);

Permissions

When you create a key, All permissions is on by default: the key can do everything the API and the MCP server expose. Turn it off to scope the key. Every permission is a resource:action pair, and each endpoint needs exactly one of them (the same permission gates the matching MCP tool).

Resource	Permissions	Gates
`workspaces`	`read`	`GET /workspaces`
`accounts`	`read`, `delete`	list and disconnect social accounts
`posts`	`read`, `create`, `update`, `schedule`, `publish`, `approve`, `delete`	posts, post lookups by URL / platform id, X analysis, and the auto-plug, comment-moderation and contact-collection settings (`update`). `create` and `update` alone only allow `schedule_type: draft`; `schedule` is also needed for `schedule_type: schedule`, `publish` for `publish_now`, and `approve` for `POST /posts/{id}/approve`
`media`	`read`, `create`, `delete`	media library; `create` covers file upload and URL import, `read` covers `POST /media/download/url`
`folders`	`read`, `create`, `update`, `delete`	media folders
`comments`	`read`, `create`, `update`, `delete`	comments; `read` also covers `POST /comments/sync`, `update` covers hiding
`analytics`	`read`	every analytics endpoint, including `POST /analytics/posts/{id}/sync`
`campaigns`	`read`, `create`, `update`, `delete`	campaigns
`labels`	`read`, `create`, `update`, `delete`	labels

The action follows the HTTP verb unless noted above: GET needs read, POST needs create, PUT/PATCH need update, DELETE needs delete.

For an AI assistant that should only draft content you approve in the app, a key with workspaces:read, accounts:read, posts:read, posts:create and media:create is enough: without posts:schedule and posts:publish every post it creates is a draft, and without posts:update and posts:delete a leaked key cannot change or remove anything you already scheduled.

Keys created before granular permissions existed keep working unchanged. Keys that were created with the older per-resource scopes keep them: the legacy posts scope still covers media, folders, comments and analytics, exactly as it did before. You can move any key to granular permissions by editing it.

A request without the required permission returns 403 Forbidden:

{
  "message": "This API key does not have the \"posts:delete\" permission. Edit the key in PostSyncer under Settings → API integrations to grant it."
}

Error Responses

If authentication fails, you’ll receive a 401 Unauthorized response:

{
  "message": "Unauthenticated."
}

Common authentication errors:

Error Code	Description
`Unauthenticated.`	Invalid or missing API key
`Expired`	API key has expired
`This API key does not have the "..." permission.`	`403` - the key lacks the permission the endpoint needs

Start here

Guides

MCP

API reference

Authentication

Authentication

Getting Your API Key

Using Your API Key

Example Request

JavaScript Example

Python Example

Python Example

PHP Example

Permissions

Error Responses

​Authentication

​Getting Your API Key

​Using Your API Key

​Example Request

​JavaScript Example

​Python Example

​Python Example

​PHP Example

​Permissions

​Error Responses

Authentication

Getting Your API Key

Using Your API Key

Example Request

JavaScript Example

Python Example

Python Example

PHP Example

Permissions

Error Responses