---
title: "Hitelesítés és jogosultságok | Posty dokumentáció"
description: "API-kulcs, MCP-kulcs, OAuth-token: melyik mire való, hogyan készíted el, és mit jelentenek a scope-ok."
canonical: https://posty.hu/en/docs/api/authentication
source: https://posty.hu/en/docs/api/authentication.md
---

Nyilvános API

# Hitelesítés és jogosultságok

API-kulcs, MCP-kulcs, OAuth-token: melyik mire való, hogyan készíted el, és mit jelentenek a scope-ok.

## The three credentials

| Type | Prefix | Where you use it | Where it comes from |
| --- | --- | --- | --- |
| API key | `psty_…` | REST API and the command-line tool | Settings → Developers |
| MCP key | `psty_mcp_…` | MCP server, for chat clients | Settings → Developers |
| OAuth token | `pos_…` | When an app acts on someone else's behalf | At the end of the OAuth flow |

REST keys and MCP keys are not interchangeable

The MCP server deliberately rejects REST keys that start with `psty_` and explains why. If a chat client cannot connect, this is the most common reason.

## The API key

You create the key in Posty, on the Settings → Developers page. You don't need to write to us, and there's no approval process. The key is shown once, at the moment you create it. You cannot retrieve it later.

Every request sends the key in the `Authorization` header. The key is the header's **entire** value:

```
curl https://api.posty.hu/public/v1/integrations \
  -H "Authorization: psty_a_kulcsod"
```

Kód másolása

An OAuth token, however, has a `Bearer` prefix:

```
curl https://api.posty.hu/public/v1/integrations \
  -H "Authorization: Bearer pos_a_tokened"
```

Kód másolása

## Permissions

You can restrict the key: only allow the operations it actually needs. These are the scopes, and the `https://api.posty.hu/public/v1/status` response lists them too.

| Scope | What it allows |
| --- | --- |
| `posts:read` | Read the calendar and posts. |
| `posts:draft` | Create, edit, and delete drafts. |
| `posts:publish` | Schedule and publish immediately, and move a post out of draft. |
| `channels:read` | Read channels, groups, and settings schemas. |
| `channels:write` | Start connecting a channel. |
| `media:write` | Upload to the media library. |
| `analytics:read` | Read statistics. |

MCP has two scopes: `mcp:read` and `mcp:write`.

Give as little as possible

An agent that creates drafts only needs `posts:read` and `posts:draft`. Then if something goes wrong, the worst that can happen is an unnecessary draft, not a post that went out to a real audience.

## Choosing a workspace

If a key belongs to more than one workspace, the `showorg` header selects which one the call applies to:

```
curl https://api.posty.hu/public/v1/integrations \
  -H "Authorization: psty_a_kulcsod" \
  -H "showorg: <munkaterulet-azonosito>"
```

Kód másolása

## 401 and 403

| Code | What it means | What to do |
| --- | --- | --- |
| 401 | The credential is missing, wrong, expired, or has been revoked. | Check that the key is the entire Authorization header value, with no Bearer. Also check that you haven't rotated it in the meantime. |
| 403 | Authentication is fine, but the permission is not enough. | The response names the missing scope and the key owner's current role. Check both. |

A 403 is usually about the user

The permission a key carries moves with its owner's current role. If someone is demoted or removed from the workspace, their key immediately has only as much access as they do. When a key that worked yesterday returns a 403 today, it is almost always this.

## Key management

- Put it in an environment variable or a secret manager, not in the code, and not in version control.
- If it ended up somewhere it shouldn't, rotate it on the Settings → Developers page. Rotation is immediate. The old key gets a 401 on the next call.
- You don't even need to copy a key for the command-line tool: `posty auth:login` stores the credential on your machine. See the [CLI authentication](https://posty.hu/en/docs/cli/authentication) page.
- Never send us the API key by email. We don't need it.

Documentation pages

Is something missing from this page? Email [norbert@posty.hu](mailto:norbert@posty.hu) or use the form on the [Help](https://posty.hu/en/help) page.