Authentication

Posta uses API keys to authenticate requests. You must include an API key in every request you make to our API. This section guides you through the process of obtaining and using API keys securely.

​

Authentication flow

The following diagram illustrates the basic authentication flow when making a request to the Posta API:

This process ensures that only authenticated clients can access the Posta API.

​

Your API keys

Your Posta account comes with pre-generated API keys. To view or manage them:

1. Log in to your Posta Dashboard
2. Click on your avatar in the top right corner
3. Select Developers from the dropdown menu
4. Navigate to the API Keys tab

Here you can view your existing API keys and rotate them if needed.

​

Using your API key

Include your API key in the X-Api-Key header with every API request:

X-Api-Key: yourApiKeyHere

​

Authentication examples

Here’s an example of how to include your API key in a cURL request:

curl https://api.posta.co/letters \
  -H "X-Api-Key: yourApiKeyHere" \

​

API key types

Posta provides two types of API keys:

1. Test keys: Used for testing and development. These start with sk_test_.
2. Live keys: Used for production. These start with sk_.

Ensure you use the appropriate key for your environment.

​

Best practices

1. Rotate keys regularly: Generate new API keys periodically and update your applications.
2. Store your keys securely: Store your API key in a secure storage such as AWS Secrets Manager or Azure KeyVault.
3. Implement access controls: Restrict API key access to only the necessary personnel and systems.

​

Troubleshooting

If you encounter authentication issues, consider the following:

• Ensure you’re using the correct API key for your environment (test or live).
• Check that the API key is correctly formatted in the X-Api-Key header.
• Verify that your API key hasn’t expired or been revoked.

If problems persist, contact our support team for assistance.