Authentication & API Keys

The Public API uses Bearer API keys prefixed with spk_.

Authorization: Bearer spk_...

Brand Scoping

Each API key is scoped to a single brand. The brand targeted by /v1/brand/* endpoints is determined by the key itself, and you cannot specify a different brand in the request body.

Only brand owners can generate and issue API keys.

Scopes & Permissions

Depending on the endpoint, the following scopes are checked:

brands:read, brands:write
connections:read
publishing:read, publishing:write
comments:read, comments:write, comments:moderate
analytics:read
webhooks:read, webhooks:write

If an API key lacks required scopes, the server returns 403 insufficient_scope.

Unauthenticated Endpoints

/
/v1/health
/v1/docs
/v1/openapi.json

Plan Quotas

Free brands are allowed 1 active API key and 1,000 counted API requests per calendar month (UTC). Growth brands support multiple active keys and operate under a fair-use policy.

Both successful and failed requests made after valid authentication count toward the Free quota. Health checks, API docs, OpenAPI schema requests, and invalid key requests are excluded from count calculations.

Security Recommendations

Store keys in environment variables or a secret management service.
Never include keys in client-side browser code.
Mask keys in logging outputs.
Deactivate unused keys and rotate them with new keys.
Separate keys per automated script to distinguish access logs.