--- title: "Posty developer docs: API, MCP, OpenAPI, CLI | Developer resources" description: "Posty developer documentation: public REST API, MCP server, OpenAPI 3 description, CLI, webhooks and OAuth 2.1 with scoped tokens. Posty's public REST API, MCP server, command line tool and OAuth apps on one page, with self-serve key creation." canonical: https://posty.hu/en/developers source: https://posty.hu/en/developers.md --- For developers and AI agents # Posty developer resources: API, MCP, OpenAPI, CLI You reach Posty's scheduler through four programmable surfaces: a public REST API, an MCP server, a command line tool and webhooks. They all manage the same account, with the same permissions you see in the web interface. This page is the reference. Per-client setup is on the [AI agents page](https://posty.hu/en/ai). Full documentation, with a page per endpoint and per platform: [posty.hu/dokumentacio](https://posty.hu/en/docs). The product user guide is there too, from connecting channels to billing. ## At a glance REST API [https://api.posty.hu](https://api.posty.hu), routes under the `/public/v1` prefix OpenAPI description [https://posty.hu/openapi.json](https://posty.hu/openapi.json), OpenAPI 3, no redirect. Scope names are under `components.securitySchemes`. MCP server [https://api.posty.hu/mcp](https://api.posty.hu/mcp) Command line tool `npm install -g posty-cli`, the command is `posty` Webhooks HMAC-SHA256 signed, in the X-Posty-Signature header OAuth 2.0 Authorization code, mandatory PKCE (S256), scoped tokens that expire Creating keys In Posty, on the Settings → Developers page, self-serve Machine-readable [/llms.txt](https://posty.hu/llms.txt), [/sitemap.xml](https://posty.hu/sitemap.xml), every page has a `.md` version ## Posty developer documentation in English: REST API, MCP server, OpenAPI, CLI Posty is a Hungarian social media scheduler. It publishes and schedules posts to 12+ social platforms, and it can be driven entirely by a machine through a public REST API, an MCP server or a command line tool. This section is the same reference as the rest of the page, in English, for developers and agents arriving from an English search. The product interface and support are Hungarian. REST API [https://api.posty.hu](https://api.posty.hu), public routes under `/public/v1` OpenAPI description [https://posty.hu/openapi.json](https://posty.hu/openapi.json), OpenAPI 3, served directly with HTTP 200 and no redirect Scopes and permissions Every scope name is declared in that document under `components.securitySchemes`, for both the API key and the OAuth 2.1 authorization code flow MCP server [https://api.posty.hu/mcp](https://api.posty.hu/mcp), streamable HTTP Authentication An API key sent as the whole Authorization header, or an OAuth 2.1 authorization code token with mandatory PKCE (S256), scoped consent and expiry Command line tool `npm install -g posty-cli`, the command is `posty`. The package ships a `SKILL.md` describing every command Webhooks HMAC-SHA256, signed in the `X-Posty-Signature` header, in Stripe's `t=…,v1=…` shape Machine-readable site [https://posty.hu/llms.txt](https://posty.hu/llms.txt), [/sitemap.xml](https://posty.hu/sitemap.xml), and a `.md` twin of every public page ### Getting started is self-serve - **Sign-up:** self-serve at [https://posty.hu/regisztracio](https://posty.hu/regisztracio). Registration is free and involves no sales call, no demo request, no waiting list and no manual approval. - **API keys:** self-serve. You create them yourself after signing up, inside the app under Beállítások → Fejlesztők (Settings → Developers): an API key for the REST API and the CLI, an MCP key for chat clients. Nobody has to issue one for you, and no sales contact is involved. A key is shown once, at creation. - **Free tier:** there is no permanently free publishing plan. Up to 5 channels can be connected before subscribing, so a new account can see its own channels, but nothing is published or scheduled without a plan. Every plan starts with a 7 day free trial. A card is collected when the trial starts, because checkout is a Stripe subscription session, and nothing is charged during the trial. - **Support:** [norbert@posty.hu](mailto:norbert@posty.hu). ## Public REST API The REST API answers at [https://api.posty.hu](https://api.posty.hu). Public routes sit under the `/public/v1` prefix. It manages the same workspace as the web interface, just from your code. ### Authentication Every request carries an API key in the `Authorization` header. You create the key in Posty, on the Settings → Developers page. You do not need to write to us for that. The key is shown once, at the moment you create it, and cannot be retrieved later, so save it immediately. Keys can be scoped: their permissions move with the owner's current role, and a key belonging to a user who leaves the workspace stops working. If a key belongs to more than one workspace, the `showorg` header selects which one the call applies to. ### What v1 can do - List connected social accounts: `GET https://api.posty.hu/public/v1/integrations` - Create and schedule a post: `POST https://api.posty.hu/public/v1/posts` - Query the calendar, update, delete: `GET https://api.posty.hu/public/v1/posts`, `DELETE https://api.posty.hu/public/v1/posts/:id` - Upload media from a file or a URL: `POST https://api.posty.hu/public/v1/upload`, `POST https://api.posty.hu/public/v1/upload-from-url` - A browser upload link, when the file is on the user's device: `POST https://api.posty.hu/public/v1/upload-link`, `GET https://api.posty.hu/public/v1/upload-link/:id` - Find the next free slot: `GET https://api.posty.hu/public/v1/find-slot/:id` - Analytics for a channel and a post: `GET https://api.posty.hu/public/v1/analytics/:integration` ### Status and discovery without authentication `GET https://api.posty.hu/public/v1/status` is the only route that answers without a key. It returns the API version, the exact server time in UTC, and absolute URLs for every machine-readable document: the OpenAPI description, the OAuth metadata, the MCP endpoint. It does not return workspace data, and it accepts no parameters. An agent can use it to decide, in one call, whether we are reachable and where to look next. ### Errors Every error returns JSON. In errors raised by Posty, the `msg` field carries the human sentence. Calls that fail request validation get the framework shape (`statusCode`, `message`, `error`). A permissions 403 names the missing scope and the key owner's current role, because the most common cause is not a badly created key, but a demoted user. The OpenAPI document's `ApiError` schema describes all of this in a machine-readable way, per status code, including whether it is worth retrying. ### Rate limits Every response carries the `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` (in seconds) and `RateLimit-Policy` headers, with a separate budget per route. A 429 also comes with `Retry-After`. Do not wait for the 429: you can slow down in advance from the remaining value. ### Versioning and deprecation The version is in the path. Every public call lives under `/public/v1`. A breaking change would appear as a new version (`/public/v2`), and `v1` would keep its contract. Additions (a new optional field, a new route, a new enum value) happen inside v1, so your client code should ignore fields it does not know. If we deprecated a route, its response would get a `Deprecation: true` header, a `Sunset` header with the date after which it no longer works, and a `Link` header with the details. The `Sunset` date is never closer than 180 days from the first `Deprecation` header. Nothing is currently deprecated. ## MCP server The MCP server address is [https://api.posty.hu/mcp](https://api.posty.hu/mcp), with streamable HTTP transport. Through it, your agent sees the same channels and schedules into the same calendar as you. - Key for clients: an MCP key starting with `psty_mcp_…`, from the Settings → Developers page. The MCP server deliberately refuses REST keys that start with `psty_…`, and it says why. - Key for apps: an OAuth access token starting with `pos_…`. It expires, can be refreshed, and is only valid for the address it was issued for. - You copy a ready-made setup block for Claude, ChatGPT, Muse, Hermes and OpenClaw from the Settings → Developers page. The write-up is on the [AI agents page](https://posty.hu/en/ai). ## Command line tool The `posty-cli` package is published on npm. Install: `npm install -g posty-cli`, and the command is `posty`. Sign in with browser approval: `posty auth:login`. The package includes `SKILL.md`, which describes every command and flag. An agent with a shell learns how to use it from that file, without reading a web page. The CLI writes the JSON response to stdout, status and errors to stderr, and on a failed run it exits non-zero, so the calling program knows what happened. ## Webhooks You set webhooks up in Posty, and every delivery is signed. The signature arrives in the `X-Posty-Signature` header, in the shape `t=,v1=`. That is deliberately the same shape as Stripe's signature, so existing verification libraries work with it. - The signature is computed over the **raw request body**. If your framework first parses it as JSON and re-serializes it, you get a different string, and verification fails. - The timestamp is part of the signature. That is the replay protection. The tolerance is 300 seconds. - You get the signing secret when you create the webhook, and you can regenerate it in Posty at any time. ## OAuth apps If you are not managing your own account, but other people's from an app, you use OAuth. Authorization goes through the authorization code flow, and the following are required. - A PKCE `S256` challenge on every request. A client without a secret can be registered, but not without PKCE. - `redirect_uri` must match the registered list exactly. - Tokens expire, and we rotate the refresh token. We only store their hashed form. - The token is good for the scopes the user consented to, and on every call we intersect that with the user's current role. A demotion takes effect on the next call. - An app can be authorized by a workspace member with the SUPERADMIN role. ## Access and getting started The whole flow is self-serve. You do not need to talk to sales, and you do not need to request a demo. - You register on the [/regisztracio](https://posty.hu/regisztracio) page. Registration is free. - You connect your social accounts with the usual OAuth flow. - You create a key on the Settings → Developers page: an API key for the REST API and the CLI, an MCP key for the chat client. - Every plan starts with a 7\-day free trial. We ask for a card to start the trial, but we charge nothing during it. 0 Ft is due today, and you can cancel anytime before it ends. Prices are on the [pricing section](https://posty.hu/en/pricing). ## Machine-readable If you are writing an agent, do not parse HTML. Every public page on the site has a Markdown version: put a `.md` suffix at the end of the path. The home page is [/index.md](https://posty.hu/index.md). Product summary [https://posty.hu/llms.txt](https://posty.hu/llms.txt) OpenAPI description [https://posty.hu/openapi.json](https://posty.hu/openapi.json) Full page list [https://posty.hu/sitemap.xml](https://posty.hu/sitemap.xml) This page in Markdown [https://posty.hu/fejlesztok.md](https://posty.hu/fejlesztok.md) Pricing in machine-readable form [https://posty.hu/arak.md](https://posty.hu/arak.md) ## If you get stuck Write to [norbert@posty.hu](mailto:norbert@posty.hu), or use the form on the [Help](https://posty.hu/en/help) page. On weekdays we usually reply within a day.