---
title: "API authentication and keys: 1Post docs"
url: "https://get1post.com/docs/api-authentication.md"
canonical_url: "https://get1post.com/docs/api-authentication"
last_updated: "2026-10-26"
type: "reference"
summary: "How keys work: bound to a workspace and a member, scoped to read or write, sent as a bearer token and revoked when a member leaves."
related: ["https://get1post.com/docs/quickstart.md", "https://get1post.com/docs/api-rate-limits.md", "https://get1post.com/docs/api.md", "https://get1post.com/docs.md"]
---

# API authentication and keys: 1Post docs

How keys work: bound to a workspace and a member, scoped to read or write, sent as a bearer token and revoked when a member leaves.

Send your key as Authorization: Bearer op_live_... or in X-Api-Key. A key is bound to one workspace and to the member who made it, with scope read or write. It acts with that member's role and stops working if they leave. A read key cannot change anything.

## What a key can do

- Scope read: GET routes only.
- Scope write: every route the member's role allows.
- A contributor's key saves posts into review even when the request asks to publish.
- Approving needs a role that approves and the approval switch only the workspace owner sets.

Every route in the [API reference](https://get1post.com/docs/api.md) lists the role action and the key scope it needs. Keys are shown once when made; store them like a password.

## Questions

**Where do assistants sign in?**

MCP clients can sign in with OAuth. See [MCP authentication](https://get1post.com/docs/mcp-oauth.md).

## Related

- [Quickstart: 1Post docs](https://get1post.com/docs/quickstart.md)
- [Rate limits and request size: 1Post docs](https://get1post.com/docs/api-rate-limits.md)
- [1Post API reference: every route, key and role](https://get1post.com/docs/api.md)
- [1Post docs: composer, scheduling, API, webhooks, MCP](https://get1post.com/docs.md)