Authentication
API keys for your code, OAuth for AI apps, and how to keep both safe.
Every request to the API and the MCP server carries a bearer credential:
Authorization: Bearer pf_3kQ…There are two kinds. Both reach exactly one workspace and act as one member of it.
| API key | OAuth access token | |
|---|---|---|
| Looks like | pf_… |
pfa_… |
| For | Your scripts, n8n, Make, Zapier, CLIs and coding agents | Apps that sign in: Claude, ChatGPT, other OAuth MCP clients |
| Created by | The workspace owner, in Settings | Any member, by approving the app |
| Lifetime | Until deleted | 1 hour; the app refreshes it for up to 90 days of inactivity |
| Access | Full or read-only, chosen at creation | Full or read-only, chosen on the consent screen |
| Where it works | REST API and MCP server | MCP server (and the REST API) |
API keys
Section titled “API keys”- The owner creates keys in Settings → Integrations → API & MCP, up to 10 per workspace, each Full access or Read only (permissions).
- The key is shown once. PostFlow keeps only a hash, the first characters and when it was last used.
- A key acts as the owner who created it. If they leave the workspace, the key stops working.
- Deleting a key stops every app using it immediately.
OAuth for MCP clients
Section titled “OAuth for MCP clients”Apps that support MCP authorization (Claude, ChatGPT) don’t need a key. When they connect to https://postflow.biz.id/api/mcp
they get a 401 pointing to PostFlow’s sign-in, register themselves, and send the member to a consent screen to pick a
workspace and access level. Tokens act as that member, with their role.
The owner sees every connected app in Settings → Integrations → Connected AI apps and can disconnect any of them. Details for client developers: MCP server → OAuth.
What a credential can’t do
Section titled “What a credential can’t do”No key or token can connect or disconnect social accounts, invite or remove people, change billing or the subscription, or create other keys. Those stay in the app.