Authentication
Personal API tokens
Section titled “Personal API tokens”Create a token on the API & AI assistants page in the app. Tick the scopes it needs, copy it once, and send it on every call:
Authorization: Bearer agp_…Scopes
Section titled “Scopes”| Scope | Allows |
|---|---|
posts:read |
List workspaces, accounts, posts, usage |
posts:write |
Create, edit and delete posts; upload media |
posts:publish |
Schedule, reschedule, unschedule, publish now |
webhooks:read |
List webhooks, event types and deliveries |
webhooks:write |
Add, change, test and remove webhooks |
A scope is a ceiling, not a right. The token acts as you: posts:publish still needs you to be
allowed to publish in that workspace. If your role changes, the token changes with it.
OAuth apps
Section titled “OAuth apps”AI assistants such as ChatGPT and claude.ai connect with OAuth instead of a pasted token — you sign in and approve. Their access tokens are sent the same way and confined to the same public endpoints. See AI assistants (MCP).
Keep tokens secret. Revoke one from the same page at any time.