API Keys and Authentication

API key authentication

REST API requests use an API key passed via the X-API-Key header. MCP clients can use an API key or user-approved OAuth with PKCE. AI agents can start with Auth.md for OAuth discovery, client registration, user consent, token refresh, and CLI API-key provisioning.

X-API-Key: sk_live_xxxxxxxxxxxxxxxxxxxxxxxx

Generate an API key

Go to Social media studio and log in.

Open API settings

Navigate to Settings > API tab.

Create a new key

Click New API Key and give it a name.

Choose the access

Keep Full access, or select Restricted and set each resource to No access, Read or Read and write. See Scopes.

Copy the key

Click Create and copy the key.

The full key is shown only once. Store it securely. If you lose it, revoke the key and create a new one.

Permissions

Only workspace owners can create, list, and revoke API keys. A key acts on behalf of the workspace it was created in, scoped to that workspace’s data. If an owner leaves or their access changes, revoke and reissue any keys they created.

Scopes

A key has full access unless you give it scopes when you create it. Every key made before scopes existed keeps full access. A scoped key can call only the endpoints that its scopes cover. Any other endpoint returns 403 Forbidden with the missing scope in the message.

A GET endpoint needs <resource>:read.
A POST, PUT, PATCH or DELETE endpoint needs <resource>:write.
<resource>:write includes <resource>:read.

Resource	Scopes	Endpoints
`accounts`	`accounts:read`, `accounts:write`	`/v1/accounts`
`posts`	`posts:read`, `posts:write`	`/v1/posts`, `/v1/drafts`, `/v1/approvals`
`media`	`media:read`, `media:write`	`/v1/media`
`analytics`	`analytics:read`	`/v1/analytics`
`inbox`	`inbox:read`, `inbox:write`	`/v1/inbox`
`ai`	`ai:read`, `ai:write`	`/v1/ai`
`biolinks`	`biolinks:read`, `biolinks:write`	`/v1/biolinks`
`teams`	`teams:read`, `teams:write`	`/v1/teams`
`settings`	`settings:read`, `settings:write`	`/v1/settings` (see the exceptions below)
`webhooks`	`webhooks:read`, `webhooks:write`	`/v1/webhooks`
`support`	`support:read`, `support:write`	`/v1/support`
`templates`	`templates:read`	`/v1/templates`
`whatsapp`	`whatsapp:read`, `whatsapp:write`	`/v1/whatsapp`

Exceptions:

POST /v1/media/validate needs only media:read, because it changes nothing.
POST /v1/templates/{id}/render needs only templates:read.
These endpoints need a full-access key: PATCH /v1/settings/profile, all of /v1/settings/api-keys and all of /v1/settings/tenants. A scoped key cannot make a new key or reach other workspaces.
The MCP server does not accept scoped keys. Use a full-access key or connect with OAuth.
teams:write cannot invite or promote owners. Only a full-access key can grant the owner role.
A scoped key can subscribe to, list and retry only the webhook events it can read. For example, inbox events need inbox:read and post, draft and approval events need posts:read. The knowledge, organization, account, auth, api_key, integration, subscription, referral, mcp and quota events need a full-access key.

To make a scoped key through the API, send scopes to POST /v1/settings/api-keys with a full-access key:

curl https://api.so-me.studio/v1/settings/api-keys \
  -H "X-API-Key: sk_live_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"name": "Zapier", "scopes": ["accounts:read", "posts:write", "media:write"]}'

Leave out scopes for a full-access key. You cannot change the scopes of a key. Revoke it and make a new one.

Using your API key

REST API

Pass the key in the X-API-Key header:

curl https://api.so-me.studio/v1/posts \
  -H "X-API-Key: sk_live_xxxxxxxxxxxxxxxxxxxxxxxx"

MCP Server

The MCP server uses the same API key. It accepts only full-access keys. Pass the key in the X-API-Key header of your MCP configuration:

{
  "mcpServers": {
    "so-me-studio": {
      "url": "https://api.so-me.studio/mcp",
      "headers": {
        "X-API-Key": "sk_live_xxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

Plan requirements

REST API, CLI, and MCP access is available on every paid plan: Lite, Creator, Standard, Advanced, and Lifetime. Lite includes 250 API calls and 2,500 MCP credits a month.

Plan	API Access
Lite	Yes
Creator	Yes
Standard	Yes
Advanced	Yes
Lifetime	Yes

For full plan details, see Billing overview.

Rate limiting

API requests are rate-limited per workspace, with the exact limit determined by your plan. When you exceed the limit, you’ll receive a 429 Too Many Requests response — wait for the window to reset and retry. MCP tool calls also consume credits based on your plan. Check your usage in Settings > API, and see AI credits for how credits work.

Higher-tier plans get higher rate limits and monthly API usage allowances. See Billing overview for the limits that apply to your plan.

Getting Started

Publishing

AI Studio

Inbox & Engagement

Analytics

Biolink

Team & Collaboration

Settings & Billing

API key authentication

Generate an API key

Permissions

Scopes

Using your API key

REST API

MCP Server

Plan requirements

Rate limiting

​API key authentication

​Generate an API key

​Permissions

​Scopes

​Using your API key

​REST API

​MCP Server

​Plan requirements

​Rate limiting

API key authentication

Generate an API key

Permissions

Scopes

Using your API key

REST API

MCP Server

Plan requirements

Rate limiting