Authentication

Every request to the Post-EZ public API is authenticated with a bearer token. Tokens are created from the in-app dashboard under Settings -> API keys and are scoped to the operations they can perform. We never echo the secret back after creation, so write it down somewhere your secrets manager can read.

Token shape

Plaintext keys look like pz_ followed by a 43-character base64url string. The pz_ prefix is there so the secret is visibly distinct from anything else floating around in your environment, and so log scrubbers can pattern-match on it.

pz_aaaaaaaa_bbbbbbbb_cccccccc_dddddddd_ee

We only store a SHA-256 hash of the key. If you lose it, mint a new one — there's no recovery flow.

Sending the token

Set the standard Authorization header on every request. Anything missing the header (or sending a malformed token) gets a 401.

curl -X GET https://postez.app/api/v1/accounts \
  -H "Authorization: Bearer pz_YOUR_KEY_HERE"

Scopes

Each key carries an explicit set of scopes. The endpoint will return 403 if the key doesn't carry the scope it needs. The current scope catalog:

• — POST /api/v1/publish (immediate publish)