Create a team API key
curl --request POST \
--url https://posted-api.example.com/api/team-credentials \
--header 'Content-Type: application/json' \
--header 'Origin: <origin>' \
--cookie posted_session= \
--data '
{
"name": "<string>",
"includeAdmin": true,
"expiresAt": "2023-11-07T05:31:56Z"
}
'import requests
url = "https://posted-api.example.com/api/team-credentials"
payload = {
"name": "<string>",
"includeAdmin": True,
"expiresAt": "2023-11-07T05:31:56Z"
}
headers = {
"cookie": "posted_session=",
"Origin": "<origin>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
cookie: 'posted_session=',
Origin: '<origin>',
'Content-Type': 'application/json'
},
body: JSON.stringify({name: '<string>', includeAdmin: true, expiresAt: '2023-11-07T05:31:56Z'})
};
fetch('https://posted-api.example.com/api/team-credentials', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://posted-api.example.com/api/team-credentials",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'includeAdmin' => true,
'expiresAt' => '2023-11-07T05:31:56Z'
]),
CURLOPT_COOKIE => "posted_session=",
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"Origin: <origin>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://posted-api.example.com/api/team-credentials"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "posted_session=")
req.Header.Add("Origin", "<origin>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://posted-api.example.com/api/team-credentials")
.header("cookie", "posted_session=")
.header("Origin", "<origin>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://posted-api.example.com/api/team-credentials")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["cookie"] = 'posted_session='
request["Origin"] = '<origin>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}"
response = http.request(request)
puts response.read_body{
"credential": {
"id": "66666666-6666-4666-8666-666666666666",
"name": "Studio assistant",
"accessLevel": "read",
"includeAdmin": false,
"tokenType": "api-key",
"tokenPrefix": "pst_example",
"createdAt": "2027-01-18T09:30:00.000Z",
"expiresAt": null,
"revokedAt": null
},
"token": "example-private-key-returned-once"
}{
"error": {
"code": "<string>",
"message": "<string>",
"requestId": "<string>"
}
}Create a team API key
Requires recent authentication. Returns the new bearer secret once. Read access cannot mutate; includeAdmin requests administrative operations within the actor’s authority.
POST
/
api
/
team-credentials
Create a team API key
curl --request POST \
--url https://posted-api.example.com/api/team-credentials \
--header 'Content-Type: application/json' \
--header 'Origin: <origin>' \
--cookie posted_session= \
--data '
{
"name": "<string>",
"includeAdmin": true,
"expiresAt": "2023-11-07T05:31:56Z"
}
'import requests
url = "https://posted-api.example.com/api/team-credentials"
payload = {
"name": "<string>",
"includeAdmin": True,
"expiresAt": "2023-11-07T05:31:56Z"
}
headers = {
"cookie": "posted_session=",
"Origin": "<origin>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
cookie: 'posted_session=',
Origin: '<origin>',
'Content-Type': 'application/json'
},
body: JSON.stringify({name: '<string>', includeAdmin: true, expiresAt: '2023-11-07T05:31:56Z'})
};
fetch('https://posted-api.example.com/api/team-credentials', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://posted-api.example.com/api/team-credentials",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'includeAdmin' => true,
'expiresAt' => '2023-11-07T05:31:56Z'
]),
CURLOPT_COOKIE => "posted_session=",
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"Origin: <origin>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://posted-api.example.com/api/team-credentials"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "posted_session=")
req.Header.Add("Origin", "<origin>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://posted-api.example.com/api/team-credentials")
.header("cookie", "posted_session=")
.header("Origin", "<origin>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://posted-api.example.com/api/team-credentials")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["cookie"] = 'posted_session='
request["Origin"] = '<origin>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"includeAdmin\": true,\n \"expiresAt\": \"2023-11-07T05:31:56Z\"\n}"
response = http.request(request)
puts response.read_body{
"credential": {
"id": "66666666-6666-4666-8666-666666666666",
"name": "Studio assistant",
"accessLevel": "read",
"includeAdmin": false,
"tokenType": "api-key",
"tokenPrefix": "pst_example",
"createdAt": "2027-01-18T09:30:00.000Z",
"expiresAt": null,
"revokedAt": null
},
"token": "example-private-key-returned-once"
}{
"error": {
"code": "<string>",
"message": "<string>",
"requestId": "<string>"
}
}A signed-in human administrator is required. API keys and MCP credentials cannot replace that session. Sensitive operations can also require recent authentication.
Requires recent authentication. Returns the new bearer secret once. Read access cannot mutate; includeAdmin requests administrative operations within the actor’s authority.
Request conventions · API keys · MCP connections
Authorizations
Signed-in human browser session; mutation requests also need the exact UI Origin
Headers
The exact configured Posted UI origin. Required for browser mutations carrying session cookies.
Body
application/json
Required string length:
1 - 120Available options:
read, edit Pattern:
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$Was this page helpful?
