API Keys & Scopes
Create a Reepl API key, choose the scopes it needs, and understand how keys are authenticated, limited, and revoked.
An API key authenticates your code against the Reepl REST API at https://api.reepl.io/v1. Every key carries a set of scopes that decide exactly what it is allowed to do, so a key built for one integration cannot quietly do everything else in your account.
API keys require a Pro plan or above. Every endpoint except GET /external/me also requires an active paid subscription at the time of the call.
Create a key
Open Settings → Developers
Go to Settings → Developers. The page has two tabs: API keys and Webhooks. You start on API keys.
Pick a platform, or go custom
Each card is a preset. Zapier, Make.com, Pabbly Connect, ViaSocket, n8n and Raycast come pre-ticked with the scopes those tools actually use. Custom API is the one to pick when you are writing your own code.
Choose scopes
Tick only what the integration needs — see the table below. You can widen a key later, but a key that can only read drafts is a much smaller problem if it leaks.
Generate and copy it
Click Generate Key. The key appears once.
Copy the key immediately. Reepl stores only a hash of it, so once you close that dialog the full key cannot be shown again — you can only revoke it and make a new one.
You can hold up to 10 keys at a time.
Authenticating a request
The preferred header is X-API-Key:
curl https://api.reepl.io/v1/external/me \
-H "X-API-Key: rpl_live_your_key_here"A bearer token works too, if that fits your HTTP client better:
curl https://api.reepl.io/v1/external/me \
-H "Authorization: Bearer rpl_live_your_key_here"Keys always look like rpl_live_ followed by 32 alphanumeric characters.
The API also accepts a key as an ?api_key= query parameter, for webhook receivers that cannot set headers. Avoid it everywhere else — query strings end up in server logs, browser history, and Referer headers. Use X-API-Key unless you genuinely cannot.
Scopes
| Scope | What it allows |
|---|---|
user:read | Read your account and profile information |
drafts:read | View and list your drafts |
drafts:write | Create, update, and delete drafts |
posts:read | View published and scheduled posts |
posts:write | Schedule and publish posts to LinkedIn |
carousel:read | Read your carousels |
carousel:write | Create, update, and delete carousels |
articles:read | Read your long-form articles |
tools:use | Use supported AI tools, including virality checking and carousel generation |
webhooks:manage | Create, update, and test webhook subscriptions |
twitter:read | View X posts and analytics |
twitter:write | Create, update, and delete X posts |
threads:read | View Threads posts and analytics |
threads:write | Create, update, and delete Threads posts |
gbp:read | View Google Business posts, reviews, and analytics |
gbp:write | Create Google Business posts and reply to reviews |
contacts:read | View and list contacts |
contacts:write | Create, update, and delete contacts |
Threads and Google Business Profile are not available yet. The scopes and endpoints exist, but neither platform can be connected in the Reepl app, so a key holding threads:* or gbp:* has nothing to act on today.
contacts:read and contacts:write are deprecated. Contacts have been removed from the Reepl app and the public /external/contacts routes have been removed. Do not build anything new on them.
If a request needs a scope your key does not have, it fails with 403 and the response names the scope that was missing. See Errors & rate limits.
Managing a key
Back on Settings → Developers → API keys, click Manage on a key to see its status, when it was created, how many requests it has served, and its permissions. From there you can:
- Edit its permissions — add or remove scopes without changing the key itself, so nothing using it needs updating
- Disable it temporarily, without deleting it — useful when you suspect a leak but are not sure yet
- Regenerate it, which issues a new secret and immediately invalidates the old one
- Revoke it permanently
Regenerating and revoking both take effect straight away. Anything still using the old key starts getting 401.
If a key leaks
Revoke or regenerate it first, then work out what happened. A leaked key can do anything its scopes allow until it is revoked, and Reepl cannot tell your traffic from an attacker's.