> ## Documentation Index
> Fetch the complete documentation index at: https://docs.postlybee.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate REST API requests with a workspace Bearer token.

Every Public API request requires a workspace API key. Generate or copy the key from **Settings → Public API** in the PostlyBee dashboard.

## Bearer header

Send the key in the `Authorization` request header using the Bearer scheme:

```http theme={null}
Authorization: Bearer YOUR_API_KEY
```

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.postlybee.com/public/v1/integrations \
    --header "Authorization: Bearer $POSTLYBEE_API_KEY"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch(
    'https://api.postlybee.com/public/v1/integrations',
    {
      headers: {
        Authorization: `Bearer ${process.env.POSTLYBEE_API_KEY}`,
      },
    }
  );

  const accounts = await response.json();
  ```

  ```python Python theme={null}
  import os
  import requests

  response = requests.get(
      "https://api.postlybee.com/public/v1/integrations",
      headers={
          "Authorization": f"Bearer {os.environ['POSTLYBEE_API_KEY']}"
      },
  )

  accounts = response.json()
  ```
</CodeGroup>

## Unauthorized requests

Missing, malformed, or unknown tokens return `401 Unauthorized`.

```json theme={null}
{
  "msg": "Missing or invalid bearer token"
}
```

The API does not accept a raw key such as `Authorization: YOUR_API_KEY`. The `Bearer` prefix is required.

## Keep keys safe

* Store keys in environment variables or a managed secret store.
* Call PostlyBee from trusted server-side code, not a public browser bundle.
* Never put keys in URLs, analytics events, screenshots, or support messages.
* Rotate a key immediately if it is exposed.

<Note>
  REST API keys and OAuth-issued MCP access tokens both use the Bearer header,
  but they are different credentials and should not be interchanged.
</Note>