01
API keys
Workspace owners and admins create keys in the dashboard under API keys. A key looks like rs_live_ followed by 40 characters. It is shown once: Reelspan keeps only a SHA-256 hash, so a lost key can’t be recovered, only replaced.
The list shows each key’s first 12 characters, when it was last used, and lets you revoke it at once.
02
Sending the key
Put it in the Authorization header. Both schemes work and the word is not case-sensitive:
Authorization: Apikey rs_live_…
Authorization: Bearer rs_live_…- 401 Authorization header required
- No header was sent.
- 401 Invalid API key
- The key is wrong or was revoked.
- 401 API key expired
- Its expiry date has passed; create a new one.
- 429 AUTH_RATE_LIMITED
- Ten failed attempts from one IP within 5 minutes; wait for Retry-After (300 s).
03
Scopes
A key can do only what its scopes allow. A key with no scopes ticked can do everything. A call outside them answers 403 INSUFFICIENT_SCOPE.
- publish
- Upload and post, schedule, edit or cancel scheduled posts, retry, upload media.
- read
- Request status, history, scheduled posts and the queue.
- profiles
- Create, rename and delete profiles, queue settings, connect links.
- analytics
- Account and post numbers.
- webhooks
- Manage webhook endpoints and deliveries.
New keys start with every scope except webhooks ticked.
04
Profile-limited keys
Give a key only some profiles, for example one per client. Calls for another profile answer 403 PROFILE_FORBIDDEN, and that profile’s posts and jobs look like they don’t exist (404). Account-wide webhooks need a key without a profile limit.
05
Expiry and rotation
A key can expire after 30, 90 or 365 days, or never. To rotate: create the new key, deploy it, then revoke the old one. Revoking takes effect on the next request.
06
AI agents (MCP)
The MCP server at https://app.reelspan.com/mcp accepts the same rs_live_ key in the Authorization header, or in the path as /mcp/<key> for clients that can’t set headers. Claude and ChatGPT can also sign in with OAuth, which asks you to approve the connection and needs no key. See the MCP guide.
07