Getting started
Authentication
API keys for REST, OAuth for agents. Two axes that do not mix.
API keys
Send the key as a bearer token. Keys carry scopes, and a read-only key cannot publish.
authorization: Bearer uplk_live_...
Scopes
| Name | Type | Description |
|---|---|---|
accounts:read | read | List connected channels. |
posts:read | read | Read publishing history, replies and insights. |
posts:write | write | Publish, delete, reply, hide and upload. |
offline_access | oauth | Keep the agent connected after the browser closes. |
OAuth for agents
MCP clients register themselves and go through OAuth 2.1 with PKCE. You approve in the browser and no key ever changes hands.
Common questions
API key or OAuth, which one do I use?
An API key if you call REST from your own code. OAuth if an agent connects over MCP. Mixing the two is the usual confusion, and a key pasted into an agent buys nothing.
Where does the API key go?
In the authorization header as a bearer token. It is never a query parameter, because query strings end up in logs and browser history.
I lost my key. Can I see it again?
No. We store a hash, not the key, so there is nothing to show. Revoke the old one and create a new one.