Agent keys

An agent key lets your own agent or script call the Postwyre API as you.

Create and revoke a keyCopy Anchor Link

You create keys on the Team page, which admins and owners can open. Postwyre shows the key once, so copy it then. It starts with sk_live_. Only a hash of the key is stored.

Revoke a key from the same page. It stops working at once. A key belongs to the person who created it and reaches every workspace that person is in, and it remembers the workspace it was made in. The person who created a key can revoke it everywhere. So can an owner or admin of the workspace it was made in, through the API from a signed-in session.

An owner or admin of any other workspace the creator belongs to can cut the key off in their own workspace only. The key keeps working in the creator's other workspaces. Both cases need the key's role and the creator's role in that workspace to be within the admin's own role, so an admin can't act on a key made by an owner. Keys made before Postwyre recorded a home workspace can be cut off per workspace, and revoked everywhere only by their creator.

A key has a role: member, admin or owner, set when you create it (member if you don't send one). It can't be higher than your own role, and it never acts above your role at the time of each call.

Use a keyCopy Anchor Link

Send it as a bearer token:

GET /api/workspaces
Authorization: Bearer sk_live_...

A key belongs to the person who created it, not to one workspace. It works in every workspace that person belongs to.

If that person belongs to more than one workspace, requests that act inside a workspace need an X-Workspace-Id header with the workspace's id, or they fail with a 400. GET /api/workspaces lists the ids.

Errors come back as JSON: { "error": { "code": "...", "message": "..." } }.

What a key can do todayCopy Anchor Link

Workspaces:

• GET /api/workspaces lists your workspaces and each one's access state.
• POST /api/workspaces with { "name": "..." } creates a workspace. It counts toward the workspace limits.

Accounts:

• GET /api/accounts lists the workspace's connected accounts: id, platform, handle, name, picture and status. It never returns a credential.

Posts:

• POST /api/posts creates a post. The body is body (the text), accounts (a list of { "accountId": "..." }, each optionally with its own body), optional platformOverrides (text per platform), and action.
• action is draft unless you say otherwise. A draft is saved and sent nowhere. now publishes it before the call returns. schedule needs a scheduledAt time in ISO 8601 with an offset, between now and 366 days ahead.
• Add an idempotencyKey field or an Idempotency-Key header, 8 to 100 characters, so a retried call returns the post it already made, with a 200 instead of a 201, and never posts twice.
• GET /api/posts lists posts, newest first, filtered with status (draft, scheduled, publishing, published, partial or failed), with page and pageSize.
• GET /api/posts/{id} returns one post with a result per account: status (queued, publishing, published or failed), the post's URL once published, and the platform's error if it failed.
• PATCH /api/posts/{id} changes a draft or a scheduled post that has not started: body, platformOverrides, accounts, scheduledAt, or action (now or schedule for a draft; draft takes a scheduled post back).
• DELETE /api/posts/{id} deletes a draft or a scheduled post that has not started.
• POST /api/posts/{id}/retry sends failed accounts back for another try. Add { "deliveryId": "..." } to retry one.

Each post uses the most specific text: an account's own body, then the platformOverrides entry for its platform, then the post's body.

Refusals use these codes: validation_error (400, including text over Bluesky's limit), not_found (404, including an account that belongs to another workspace), conflict (409), quota_exceeded (402, the plan's monthly posts are used up or the workspace has no plan), and not_configured (503, posting or scheduling is not turned on for the deployment).

A key can't connect or disconnect accounts, create or revoke keys, add teammates or open checkout. Those need a signed-in session.

The API also has a placeholder resource called items, left from the starter template, with its own monthly allowance. Don't build on it.

Postwyre has no MCP connector yet. Images and video cannot be attached until a platform that takes them is switched on, and Bluesky posts are text only. A TikTok post needs per-post options; see Accounts. See What's coming.