Authentication

Every request carries a credential as a Bearer token. There are two kinds.

API keys

For your own scripts, servers and automations.

Authorization: Bearer pbv_…

Create one in Settings › API keys. A key:

• acts in one Workspace, the one you made it in, as you — and stops working if you leave that Workspace;
• is shown once. Pubrivo keeps only a hash; lose it, revoke it, make another;
• schedules only, unless you tick Also allow publishing immediately when you create it. That adds the posts:publish permission, which publishing now and trying a failed Variant again need;
• labels everything it makes: the Calendar shows the key’s name beside each Post, and the API returns it as via.

Revoke a key in the same place. It stops working at once.

Caution

A key is a password for your Workspace’s Channels. Keep it on a server or in your automation tool’s credential store — never in a web page or a mobile app.

OAuth, for AI assistants

AI assistants such as Claude, ChatGPT and Cursor connect over MCP and sign in with OAuth 2.1 instead of a key. Once you approve one, it is an Authorized app: it acts in one Workspace, picked at approval if you belong to several, and you choose whether it may publish immediately or only schedule.

You see and revoke Authorized apps in Settings › Authorized apps. A revoke, or you leaving the Workspace, stops the app at once.

Pubrivo publishes its OAuth metadata for MCP clients to discover:

https://app.pubrivo.com/.well-known/oauth-protected-resource/mcp
https://app.pubrivo.com/.well-known/oauth-authorization-server

Clients register themselves — dynamically, or with a client ID metadata document — so there is no developer console to sign up for.

Permissions

Permission	What it allows	API keys	Authorized apps
posts:schedule	Read Channels and Posts, schedule, upload media, cancel	Always	Always
posts:publish	Publish now, and try a failed Variant again	When ticked	When allowed at approval
webhooks:manage	Register, list and delete webhooks	When ticked	When allowed at approval

A request without the permission it needs gets a 403 with code insufficient_scope.

Creating an API key requires a verified email address. Send a verification link from Settings › Profile before creating one. Sending or resending team invitations also requires verification.

Existing keys and Authorized apps act for their Member without an email-verification gate on publishing, scheduling or retries. Workspace membership and the credential’s permissions still apply.

Failing to authenticate

A missing, unknown or revoked credential gets a 401:

{ "error": { "code": "unauthorized", "message": "That key is not valid, or has been revoked." } }