Authenticate PostSider Agent Bridge requests with API keys

Every request to the PostSider Agent Bridge, whether through the MCP server, the REST API, or the SDK, is authenticated with an organization API key or a pos_... OAuth token. Organization keys grant access to the organization’s public API surface; there are no scoped or read-only keys. If you need to limit operational exposure, create a dedicated key per agent and revoke it when it is no longer needed.

Getting your API key

Open API settings

In the PostSider dashboard, go to Settings → API.

Create a new key

Create a key and give it a descriptive name, such as Claude Code agent, CI pipeline, or content-bot-prod. Clear names make it easy to audit usage and revoke individual keys without disrupting other integrations.

Copy your key immediately

The full key value is shown once, right after creation. Copy it somewhere safe now; PostSider does not show it again. If you lose a key, delete it and create a new one.

Using your API key

REST API
SDK
MCP server

Pass your API key as the value of the Authorization header on every request. Do not prefix it with Bearer.

curl -H 'Authorization: your-api-key' \
  https://api.postsider.com/public/v1/integrations

All /public/v1 endpoints accept this header.

Pass your API key as the first argument to the Postsider constructor. Pass the instance base URL explicitly for portable code.

import Postsider from '@postsider/node';

const client = new Postsider('your-api-key', 'https://api.postsider.com');

// All SDK methods include the key automatically
const channels = await client.integrations();

The MCP server reads your key from the POSTSIDER_API_KEY environment variable in your MCP client config. The key is never placed in a URL.

{
  "mcpServers": {
    "postsider": {
      "command": "node",
      "args": ["/absolute/path/to/apps/mcp/dist/index.js"],
      "env": {
        "POSTSIDER_API_KEY": "your-api-key",
        "POSTSIDER_API_URL": "https://api.postsider.com"
      }
    }
  }
}

See the MCP Overview for full setup steps.

Expiration and rotation

API keys do not expire automatically. They stay valid until you delete them from Settings → API. There is no automatic rotation; if you suspect a key is compromised, delete it immediately and issue a new one.

Rate limiting

The public API allows 60 requests per minute per organization by default. Every response includes rate-limit metadata:

Header	Description
`X-RateLimit-Limit`	Maximum requests allowed in the window
`X-RateLimit-Remaining`	Requests remaining in the current window
`Retry-After`	Seconds to wait before retrying, sent only on a `429`

When you exceed the limit, the API returns 429 Too Many Requests. Read Retry-After and back off for that many seconds before retrying.

Auth errors

Status	Meaning	Fix
`401 Unauthorized`	API key missing or invalid	Check that the `Authorization` header is present and the key is correct
`402 Payment Required`	Plan limit reached for channels or posts	Review your plan on the Billing page
`429 Too Many Requests`	Rate limit exceeded	Wait the number of seconds in `Retry-After`, then retry

Best practices

Create a separate API key for each agent, integration, or pipeline. Named keys make it easy to see which system made which requests, and if one key is compromised you can revoke it without affecting anything else.

Never commit API keys to source code or version control. Use environment variables or a secrets manager (such as POSTSIDER_API_KEY in your .env file) and keep .env in your .gitignore. A leaked key gives full Agent Bridge access to anyone who finds it.

​Getting your API key

​Using your API key

​Expiration and rotation

​Rate limiting

​Auth errors

​Best practices

Getting your API key

Using your API key

Expiration and rotation

Rate limiting

Auth errors

Best practices