# Authentication and API keys

How API keys work, what each permission allows, and how to keep keys safe.


Every request carries an API key as a Bearer token:

```bash
curl https://creatorhyve.com/api/v1/developer/accounts \
  -H "Authorization: Bearer ch_live_your_key_here"
```

## Creating keys

Create keys under **Settings, then Developer**. A key starts with `ch_live_`. It is shown once, then only a fingerprint is kept: CreatorHyve stores a SHA-256 hash of the key, never the key itself. You can have up to 10 keys. Rename, disable or delete a key at any time; a disabled or deleted key stops working immediately.

When you create a key you choose:

- **Permissions (scopes)**, so a key can only do what it needs.
- **An expiry**: never, 30 days, 90 days or one year. An expired key is rejected like a deleted one.

## Permissions

| Scope | Allows |
|---|---|
| `accounts:read` | List connected social accounts. |
| `posts:read` | List posts and see per-platform publishing results. |
| `posts:write` | Create, schedule, edit and delete posts. |
| `media:write` | Add images and videos to your library. |
| `analytics:read` | Read views, likes and comments of published posts. |
| `webhooks:manage` | Create and delete webhook endpoints. |
| `links:manage` | Create short links and read their click counts. |
| `mcp` | Connect this key to an AI assistant through the MCP server. |

A request without the needed scope gets `403` with `"code": "insufficient_scope"` and the scope it needed.

Keys created before permissions existed can read and write posts, as before.

## Plan requirements

API access is part of the Scale plan. Creating or scheduling posts also needs an active paid plan. If a plan lapses, requests answer `403` with `"code": "plan_required"`.

## Keeping keys safe

- Keep keys on your server. Never put one in a browser app, mobile app or public repository. All keys start with `ch_live_`, so secret scanners can find them.
- Use one key per integration so you can revoke one without breaking the others.
- Give each key the fewest permissions it needs and an expiry where you can.
- To rotate: create a new key, deploy it, then delete the old one.
- If a key leaks, delete it in the dashboard right away.

<Callout tone="warning">The `mcp` permission lets a key be used with the MCP server, which can create and delete posts. Give it only to keys you use with an AI assistant.</Callout>