Skip to main content

​
What are API keys?

API keys (Personal Access Tokens) authenticate requests to the TryPost REST API. Keys are scoped to a single workspace — an API key can only access the workspace it was created in.
API keys do not authenticate the MCP server. MCP connections use OAuth (mcp:use) via browser sign-in. Use workspace Settings → MCP to connect assistants, and Settings → API Keys for REST / scripts.

​
Creating an API key

Go to workspace Settings → API Keys and click Create API Key. After creation, the full key is shown once. Copy it immediately.
TryPost stores a hash of your API key, not the key itself. If you lose it, you’ll need to create a new one.

​
Where to use your API key

Pass the key as a Bearer token in the Authorization header for REST requests:
See the API reference for endpoints. To connect Claude, ChatGPT, Cursor, and other assistants, follow Build with AI (OAuth).

​
Expiration

API keys can be created with or without an expiration date:
  • No expiration — The key remains active until you manually delete it
  • With expiration — The key automatically becomes inactive after the set date. Requests return a 401 error
Expired keys are not deleted — they stay visible so you can track usage history. You can delete them when ready.

​
Security best practices

1

Use separate keys per use case

Create different keys for different purposes: Production API, CI/CD Pipeline. If one is compromised, you only need to rotate one.
2

Set expiration for temporary access

If you’re sharing a key with a contractor or external tool, set an expiration date.
3

Never commit keys to source control

Store keys in environment variables, .env files (not committed), or secret managers. Never hardcode them.
4

Rotate keys periodically

Create a new key, update your integrations, verify the old key’s Last used timestamp shows no recent activity, then delete it.

​
Deleting an API key

You can delete an API key at any time from the dashboard or via the API. Deletion is immediate and irreversible — any application using the key will immediately start receiving 401 errors. Check the Last used column before deleting to make sure the key isn’t actively in use.

​
FAQ

There’s no limit. Create as many as you need.
No. The full key is only shown once. TryPost stores a secure hash, not the original key.
No. API keys authenticate the REST API only. MCP requires OAuth — see Build with AI.
The API returns a 401 Unauthorized error. Create a new key to restore access.
No. Keys are scoped to the workspace where they were created. Create a separate key for each workspace.
Yes. API requests are throttled to prevent abuse. If you exceed the limit, you’ll receive a 429 status code.