Authentication

Authenticate to the Postifys publishing API with Bearer or X-API-Key headers, test your API key, and follow secure key handling practices.

Last updated: 2026-07-24 · Technical source: live Postifys API behavior and API reference

API key access

Every Postifys user can create one API key from /settings. The key can be viewed, copied, deleted, and recreated after deletion.

• Preferred header: Authorization: Bearer YOUR_API_KEY
• Alternate header: X-API-Key: YOUR_API_KEY

curl -X POST https://postifys.com/api/facebook/post \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"message":"Hello from Postifys API"}'

curl -X POST https://postifys.com/api/facebook/post \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"message":"Hello from Postifys API"}'

Test the key

curl https://postifys.com/api/key/test \
  -H "Authorization: Bearer YOUR_API_KEY"

Session access

Some dashboard/management routes use a logged-in browser session (cookie) instead of an API key. Publishing endpoints used by automation should use the API key so n8n, CRMs, and backends do not depend on a browser cookie.

Security practices

• Never commit API keys to git or paste them into public issues.
• Prefer server-side or n8n credential storage over frontend code.
• If a key is exposed, delete it in Settings and create a new one.
• Disconnect social accounts you no longer need; revoke Postifys in the platform’s security settings when permanently leaving. See Security.