Tokens
Settings → API access (Scale plan) mints tokens for the REST API and the MCP server. Each token has a name, the scopes it may use, and an expiry of 30, 90 or 365 days, or none. The token is shown once and stored only as a hash; the page shows when each was last used, and revoking one takes effect immediately. Minting and revoking are audited.
A token acts as the person who made it, in their workspace, with their brand roles: a scope says what the token may attempt, the brand role says what it may do. Tokens from before scopes existed carry every scope; the page asks their holder to replace them with a scoped one.
The API
Brands, scheduled posts, media, approvals, the inbox, campaigns, SmartLinks, analytics, paid media, report share links, team rosters and webhook subscriptions, under /api/v1. Requests are limited per token as well as per address. Full reference, the OpenAPI document and the changelog are on the developer documentation page.
Webhooks
Subscribe an HTTPS address to events and every delivery is signed with HMAC-SHA256 using the subscription's secret, which is shown once and stored encrypted. Verify the signature before trusting a delivery. Addresses on private or internal networks are refused.
MCP
The same token opens the MCP server, so an AI assistant can list brands, draft and schedule posts, decide approvals and reply in the inbox with exactly the scopes and brand roles the token carries.