Authenticate to the MisarPost API with a product-bound API key — full access, scoped to your MisarPost plan.

Overview

Every request to the MisarPost API, MCP server, and SDKs is authenticated with an API key. MisarPost keys:

are product-bound — a MisarPost key works only with MisarPost. It cannot be used with any other Misar product (Mail, Reach, Dev, Blog, SEO, …), and their keys cannot be used with MisarPost.
grant full access — a key can call every public MisarPost endpoint (read, write, update, delete). Keys are not feature-scoped; you never have to pick permissions.
are plan-gated — the number of active keys you can hold is set by your active MisarPost subscription.

API keys act on your own MisarPost account. To act on behalf of other users, you need a workspace/service integration — contact us.

Base URL — use https://post.misar.io/api/*. The MisarPost REST API is served directly from the app host. The shared api.misar.io/post/* namespace currently 302-redirects to the blog API and does not serve MisarPost endpoints — do not point integrations at it. Every path in this reference (/api/posts, /api/schedule, …) is relative to https://post.misar.io.

Creating a key

Sign in at misarpost.com and open the MisarPost dashboard at post.misar.io.
Go to Settings → API Keys.
Click Create key, give it a name (e.g. Production), and copy the secret.

The raw key is shown once at creation — store it somewhere safe. If you lose it, revoke the key and create a new one.

MisarPost keys always begin with the msk_ prefix, so they are easy to recognize in logs and secret scanners:

msk_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b

Create a key programmatically with a dashboard session: POST /api/account/api-keys with a { "name": "Production" } body returns the raw key once in the key field.

Key limits by plan

The per-plan key counts below are indicative — check Settings → API Keys for the exact allowance on your current MisarPost plan.

MisarPost plan	Active API keys
Free	1
Starter	3
Pro	10
Business	25
Enterprise	100

If you hit the limit, revoke an unused key or upgrade your plan.

Using a key

Send the key in the Authorization header as a Bearer token:

curl https://post.misar.io/api/posts \
  -H "Authorization: Bearer msk_YOUR_KEY_HERE"

The Api-Key msk_… header scheme is also accepted, but Bearer is recommended. The same key works with the MisarPost SDKs and the MCP server.

Because a MisarPost key grants full access, treat it like a password. Never embed it in client-side code, browsers, or mobile apps — call the MisarPost API only from your server.

Product binding

MisarPost validates every key against its own database. A key issued by another Misar product is not present there, so it is rejected — and vice-versa. This means:

A MisarPost msk_ key returns 401 Unauthorized on api.misar.io/mail/*, …/reach/*, …/dev/*, etc.
Any other product's key returns 401 Unauthorized on the MisarPost API (post.misar.io/api/*).

There is no way to "share" one key across products — issue a separate key from each product's dashboard for each product you integrate with.

Revoking a key

Revoke a key from Settings → API Keys (or DELETE /api/account/api-keys/{keyId} with a dashboard session). Revocation is immediate: the next request using that key returns 401.

Errors

Status	Meaning
`401 Unauthorized`	Missing, malformed, revoked, expired, or wrong-product key.
`403 Forbidden`	Key valid, but your MisarPost plan does not permit the action (or key limit reached at creation).
`429 Too Many Requests`	Rate limit exceeded — back off and retry.

See Errors for the full error model.

Authentication