API access (for developers)

Settings → Integrations (/app/settings/integrations), card API access (for developers), at the bottom of the page. Owners and admins only. "Connect OmniBrand to your own systems, Zapier or Make, to create posts, add contacts or read analytics automatically." A key lets your own software call the OmniBrand public API with the header Authorization: Bearer ob_live_… The bottom of the card, API endpoint, shows the address to send those requests to ("The address the public API answers on. Send each request there, with one of the keys above."). Older links to /app/settings#developer open this card.

Which plans include it

API access is part of the Agency and Enterprise plans. On Free, Starter and Pro, and during the 14-day Pro trial, the card shows only "API access is available on the Agency plan." with a See plans link to Plan & usage; there is no key form. The plan cards on Plan & usage and on /pricing list API access for Agency and Enterprise.

When the plan changes

• When the account moves to a plan without API access (a downgrade, a refund, or the end of a trial), its keys are paused: they stay stored and nothing is deleted, but every call made with them is refused with "API access is available on the Agency and Enterprise plans. Upgrade under Settings > Plan & usage to use API keys." (HTTP 403, code api_access_not_in_plan).
• The account owner gets one email, Your API keys are paused ("Your API keys are paused because your plan no longer includes API access…"), with a See plans button.
• Moving back to Agency or Enterprise turns the same keys on again within a minute. You do not need to create new ones.
• While paused, the keys are not listed and cannot be created or rotated. To stop a key for good, upgrade and click Revoke on it, or ask support.

Step by step: create a key

1. Type a name in Key name (for example CI bot), up to 60 characters, so you know later what uses it. With no name (or spaces only), Create key creates nothing and the box says "Give the key a name, for example "Website sync"." Spaces before and after the name are removed.
2. In Key scopes, choose read only (reading data) or read + write (also creating and changing things).
3. Click Create key.
4. A yellow box shows "New key for "(name)". Copy it now: it is shown only once." and the full key, with Copy (it then says Copied) and I have saved it, which closes the box. Copy the key now and keep it somewhere safe; OmniBrand stores only a fingerprint and can never show it again.

The list

Each key shows its name, the first characters (ob_live_…), its scope, when it was last used ("used ..." or "never used") and "expires ..." with its end date.

• Rotate: asks first: "Rotate "(name)" (prefix…)? You get a new key at once. The current key keeps working for 24 hours and then stops, so put the new key everywhere the old one is used before then." Click Rotate key to go ahead, or Cancel. The new key, with the same name and scope, is shown once in the same yellow box. The old key keeps working for 24 hours so you can switch your integration over, then stops. Until then it stays in the list, not struck through, with "Old key works until [date and time]" and a Revoke button.
• Revoke: asks "Revoke the key (name) (prefix…)? Anything using it stops working at once, and a revoked key cannot be turned back on." The window is titled Revoke key?; click Revoke key to stop the key at once, or Cancel to keep it. This also works on an old key during its 24 hours after a rotation: if you rotated because the key leaked, click Revoke on the old key so it stops now. Revoked keys (and rotated keys once their 24 hours are over) stay in the list, struck through, with a red "Revoked on (date)" label under the name.

Who owns a key

• A key belongs to the person who created it, and it covers the workspaces where that person is an owner or admin at the moment of creation.
• It works only while its creator is still an active owner or admin of every workspace it covers. If they are removed, demoted or their login is disabled, calls fail with "The person who created this API key no longer administers its workspaces. Ask a current admin to issue a new key."
• You see, rotate and revoke only the keys whose workspaces you administer yourself. In an account with many client workspaces, one client's admin cannot see another client's keys.

If something goes wrong

• "This API key has expired. Rotate it under Settings > Integrations > API access.": keys last one year. Click Rotate on it in API access (for developers) (or create a new one) and update your integration.
• "Invalid or revoked API key": the key was revoked, its 24-hour rotation grace ended, or it was copied incompletely.
• An API key cannot create, rotate or revoke other keys; only a signed-in person can.
• "This endpoint is not available to API keys": that call is for a signed-in person only, whatever the key's scope. A key can never reach: members and invitations (/workspaces/{id}/members, /workspaces/{id}/invitations, /invitations), creating, renaming, archiving, unarchiving or deleting a workspace, outbound webhooks (/workspaces/{id}/webhooks), exports, the approval chain, report schedules, connecting, disconnecting or removing a channel or changing its owner, the organisation's logo, profile and onboarding, and anything under /auth, /billing, /admin or /tenant/api-keys. Do these in the app, logged in as an owner or admin. AI through a key covers post text, ideas, images, rewrites, hashtags, alt text and message triage, up to 10 calls a minute and 300 a day per key ("API key AI rate limit exceeded"); video, AI Studio and the other AI helpers are for signed-in people only. Market Watch tasks, sources and settings, bots, and workspace settings such as auto-triage can also only be changed by a signed-in person. Turning support on or off, changing its AI classification and the Brand Health AI reading also need a signed-in person, and a report requested with a key includes an AI summary only if one already exists.

Related

• Plans
• Integrations: outbound webhooks
• Roles and permissions
• The Settings page