Authentication

Every request to the NativPost API must be authenticated with a workspace API key sent in the Authorization header.

Key format

Keys look like this:

npk_live_2f83c9a1e6b74d0aab21f7d0c9b8e4a1

• npk_ is a fixed prefix so keys are easy to spot in logs and search rules.
• live_ indicates a production key. Only production keys exist today.
• The remaining suffix is a 32-character random string.

Keys are scoped to a single workspace and carry full access to that workspace. There is one active key per workspace at a time. Rotating a key immediately invalidates the previous one.

Creating a key

1. In the dashboard, open Settings → API keys.
2. Click Create key, give it a memorable name (for example zapier-prod), and confirm.
3. Copy the plaintext key from the modal. This is the only time it will be shown.

If your workspace is not on a paying plan, the API keys tab shows an upgrade banner instead of the create button.

Using a key

Send the key as a bearer token:

curl https://app.nativpost.com/api/v1/me \
  -H "Authorization: Bearer npk_live_2f83c9a1e6b74d0aab21f7d0c9b8e4a1"

The API responds with details about the workspace attached to the key:

{
  "object": "workspace",
  "id": "org_2gK9c7dL3eX8fY1a",
  "name": "Acme Studio",
  "plan": "pro",
  "created_at": "2026-05-11T14:03:22Z"
}

Rotating and revoking

• Rotate: open the key row and choose Rotate. A new plaintext value is generated and the previous key stops working immediately.
• Revoke: choose Revoke to disable API access entirely until a new key is created.

Both actions emit a settings.api_key.revoked audit entry visible in Settings and in your webhook delivery log if you subscribe to it.

Storing keys safely

• Never commit keys to source control. Use environment variables or a secrets manager.
• Grant one key per integration. If Zapier and n8n both call the API, give each its own key so you can rotate independently.
• Rotate after any teammate with dashboard access leaves the workspace.