Getting started
Authentication
Use server-side API keys, choose the smallest useful scope, and keep tenant context explicit.
01
Send a Bearer token
Every
/api request requires a PostGate key in the Authorization header. Store the key in a secret manager or environment variable and never ship it to browser or mobile code.cURLPostGate API
curl https://postgate.studio/api/profile-groups \
-H "Authorization: Bearer $POSTGATE_API_KEY"02
Test and live modes
pg_test_ keys run the complete lifecycle against the sandbox adapter: validation, jobs, targets, delivery logs, and webhooks all behave normally, but no social network is called. pg_live_ keys can reach connected providers.Build CI against test mode
Use a test key in automated tests so your integration exercises asynchronous delivery without publishing real content.
03
Scopes
Keys can carry
read, publish, or full. Read covers retrieval and analytics; publish adds content, media, schedules, and replies; full adds destructive and administrative operations such as connection management, keys, webhooks, and environments.04
Tenant context
A group-bound key is permanently scoped to one profile group. Organization keys can pass
profile_group_id when an operation needs a publishing boundary. PostGate rejects attempts to override the group on a group-bound key.Organization key with explicit tenantPostGate API
curl "https://postgate.studio/api/profiles?profile_group_id=grp_acme123" \
-H "Authorization: Bearer $POSTGATE_API_KEY"