API Keys API Reference

Provision and revoke profile-group-scoped API keys without the dashboard. A typical use is multi-tenant onboarding: create a profile group for each of your customers, mint a key scoped to that group, and hand only that key to the customer’s integration. Anything the customer’s key does stays inside its group.

The API only mints scoped keys. profile_group_id is required, and there is no way to create another account-wide key here; those are managed in the web app. Listing and revoking likewise cover scoped keys only, so an account-wide key can never revoke itself or another account-wide key.

Keys are environment-bound: a live key lists, creates and revokes live keys; a sandbox key does the same for sandbox keys, and the target profile group must be in the same environment.

Endpoints

Method	Endpoint	Description
`GET`	`/api/api_keys`	List scoped API keys
`POST`	`/api/api_keys`	Create a scoped API key
`DELETE`	`/api/api_keys/:id`	Revoke a scoped API key

API key object

Field	Type	Description
`id`	string	API key ID, used in the revoke URL
`name`	string	Label you gave the key
`profile_group_id`	string	The profile group the key is scoped to
`sandbox`	boolean	`true` for sandbox keys
`token`	string	The secret bearer token. Returned only in the create response
`created_at`	string	ISO 8601 timestamp

List API keys

GET /api/api_keys

Returns the scoped keys in the caller’s environment, newest first. Tokens are never included.

Example

curl -X GET "https://api.postproxy.dev/api/api_keys" \
     -H "Authorization: Bearer YOUR_API_KEY"

Response:

{
  "data": [
    {
      "id": "key123abc",
      "name": "Acme Corp",
      "profile_group_id": "grp456def",
      "sandbox": false,
      "created_at": "2026-09-09T10:00:00Z"
    }
  ]
}

Create API key

POST /api/api_keys

Request body

Parameter	Type	Required	Description
`profile_group_id`	string	Yes	Profile group to scope the key to. Must belong to your account and match the caller’s environment
`name`	string	No	Label for the key, shown in the web app

Send an Idempotency-Key header to make the call safe to retry; see Idempotency. A retried create returns the original key rather than minting a second one.

Example

curl -X POST "https://api.postproxy.dev/api/api_keys" \
     -H "Authorization: Bearer YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -H "Idempotency-Key: signup-acme-corp" \
     -d '{
       "name": "Acme Corp",
       "profile_group_id": "grp456def"
     }'

Response (201 Created):

{
  "id": "key123abc",
  "name": "Acme Corp",
  "profile_group_id": "grp456def",
  "sandbox": false,
  "token": "3f9c2e1a7b...",
  "created_at": "2026-09-09T10:00:00Z"
}

Store token now. It is not returned by any later request; if it is lost, revoke the key and create a new one.

Error responses

Status	Body	Cause
`401`	`{ "error": "Invalid API key or profile group. ..." }`	`profile_group_id` does not resolve to a group of your account in this environment
`422`	`{ "errors": ["Profile group not found"] }`	`profile_group_id` missing
`422`	`{ "error": "Your API key has no such permission" }`	Caller is a scoped key or an OAuth token

Revoke API key

DELETE /api/api_keys/:id

Path parameters

Parameter	Type	Required	Description
`id`	string	Yes	API key ID

Revocation is immediate: the next request with that token returns 401. Only scoped keys in the caller’s environment can be revoked; any other id returns 404.

Example

curl -X DELETE "https://api.postproxy.dev/api/api_keys/key123abc" \
     -H "Authorization: Bearer YOUR_API_KEY"

Response:

{
  "deleted": true
}

Customer onboarding

Provision a tenant in two calls at signup, then keep only the scoped token in the customer’s context.

# 1. Create the customer's profile group
curl -X POST "https://api.postproxy.dev/api/profile_groups" \
     -H "Authorization: Bearer YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"profile_group": {"name": "Acme Corp"}}'
# => { "id": "grp456def", ... }

# 2. Mint a key scoped to it
curl -X POST "https://api.postproxy.dev/api/api_keys" \
     -H "Authorization: Bearer YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"name": "Acme Corp", "profile_group_id": "grp456def"}'
# => { "id": "key123abc", "token": "...", ... }

The customer’s integration then calls every endpoint with the scoped token. It sees only that group’s profiles, posts, comments and messages, and cannot create, list or delete profile groups or API keys. To connect the customer’s social accounts, use Initialize Connection with the group id.

On offboarding, revoke the key with DELETE /api/api_keys/:id, then delete the group once its profiles are disconnected. Deleting a profile group also deletes every key scoped to it.