Skip to main content

​
Workspace API keys

A workspace API key starts with osk_. It belongs to exactly one workspace and acts on behalf of the admin who created it.
1

Open the key manager

In your dashboard, go to Configuration → Integrations → REST API. Only workspace admins can create keys.
2

Create a key

Give it a name, pick its permissions and, optionally, an expiry date. No permissions are selected by default.
3

Copy it once

The key is shown only once. Store it in your secret manager straight away; it cannot be shown again.
If the admin who created a key leaves the workspace or stops being an admin, the key stops working. Create integration keys from an admin account that will stay in place.

​
Sending the key

Send the key in one of these headers. Both work on both APIs.
If you send both headers with different values, the request is rejected with 401.

​
Permissions

A key only gets the permissions you select when you create it. Picking “all” selects every permission that exists at that moment; permissions added to the platform later are never added to existing keys. To change a key’s permissions, create a new key, switch your integration over, then revoke the old one. Permissions narrow what the creating admin can already do; they never add to it. Plan limits and features that are switched off still apply.

​
Publishing

Creating or updating a post that schedules it (schedule, schedule_now, queue, or a date and time) also needs publishing:posts:publish.

​
Messaging

Some write permissions only appear when creating a key if your platform has Link in Bio writes switched on.

​
Webhooks

See Managing endpoints for how these combine.

​
Workspaces

  • Messaging and Link in Bio APIs: the key selects the workspace. No workspace ID appears in the URL.
  • Publishing API: the workspace UUID is part of the URL and must match the key’s workspace. A key from another workspace gets 404, even if its admin belongs to both.

​
Older credentials

Personal publishing tokens and messaging keys starting with sbk_ keep working on their own API as before. They are never converted or expired automatically. To move an integration to a workspace key: create the key, update the integration, check a read and a safe write, then revoke the old credential.
Personal publishing tokens can cover several workspaces. Revoking one can affect integrations in all of them.