Authentication
v1Scoped bearer keys, separate test and live environments, and credentials that stay on your server.
Bearer keys
Send your key in the Authorization header on every request. Keys belong to a single workspace and environment. Keys are displayed once, stored as hashes, and can be revoked from Developers.
HTTP
Authorization: Bearer cr_test_your_key| Prefix | Environment | Behavior |
|---|---|---|
cr_test_ | Test | Simulated accounts and publishing. No live social post. |
cr_live_ | Live | Real connected accounts. Platform permissions and approvals apply. |
Choose the smallest useful scope
| Scope | Allows |
|---|---|
accounts:read | List connected accounts and capabilities |
accounts:write | Create test accounts and disconnect accounts |
posts:read | List and retrieve posts |
posts:write | Create and cancel posts |
comments:read | List supported post comments |
comments:write | Reply to supported comments |
webhooks:read | Inspect endpoints and deliveries |
webhooks:write | Create and disable webhook endpoints |
logs:read | Inspect API request logs |
Keep secrets on your server
Never put keys in browser code, mobile bundles, screenshots, or public repositories. Use separate keys for separate services. Create a replacement before revoking a key used by an active integration.
API keys cannot create other API keys. Key administration requires a signed-in workspace session.