API
Authentication and API keys
How API keys work, what each permission allows, and how to keep keys safe.
Every request carries an API key as a Bearer token:
curl https://creatorhyve.com/api/v1/developer/accounts \
-H "Authorization: Bearer ch_live_your_key_here"
Creating keys
Create keys under Settings, then Developer. A key starts with ch_live_. It is shown once, then only a fingerprint is kept: CreatorHyve stores a SHA-256 hash of the key, never the key itself. You can have up to 10 keys. Rename, disable or delete a key at any time; a disabled or deleted key stops working immediately.
When you create a key you choose:
- Permissions (scopes), so a key can only do what it needs.
- An expiry: never, 30 days, 90 days or one year. An expired key is rejected like a deleted one.
Permissions
| Scope | Allows |
|---|---|
accounts:read | List connected social accounts. |
posts:read | List posts and see per-platform publishing results. |
posts:write | Create, schedule, edit and delete posts. |
media:write | Add images and videos to your library. |
analytics:read | Read views, likes and comments of published posts. |
webhooks:manage | Create and delete webhook endpoints. |
links:manage | Create short links and read their click counts. |
mcp | Connect this key to an AI assistant through the MCP server. |
A request without the needed scope gets 403 with "code": "insufficient_scope" and the scope it needed.
Keys created before permissions existed can read and write posts, as before.
Plan requirements
API access is part of the Scale plan. Creating or scheduling posts also needs an active paid plan. If a plan lapses, requests answer 403 with "code": "plan_required".
Keeping keys safe
- Keep keys on your server. Never put one in a browser app, mobile app or public repository. All keys start with
ch_live_, so secret scanners can find them. - Use one key per integration so you can revoke one without breaking the others.
- Give each key the fewest permissions it needs and an expiry where you can.
- To rotate: create a new key, deploy it, then delete the old one.
- If a key leaks, delete it in the dashboard right away.
mcp permission lets a key be used with the MCP server, which can create and delete posts. Give it only to keys you use with an AI assistant.