Browse docs
API keys — for your own scripts#
Create one in Settings → Developer (Owner/Manager). It carries a curated set of scopes, and its effective power is always scopes ∩ your role — a key can never do more than the member who owns it could do by hand. Send it as a Bearer token on every request.
http
GET /v1/agency HTTP/1.1
Host: api.skedcast.com
Authorization: Bearer sked_live_AB12…OAuth 2.1 — for third-party apps and AI agents#
When your app acts on behalf of someone else's SkedCast workspace, use the Authorization Code flow with PKCE (S256 required). Clients register dynamically (RFC 7591) — no manual app-store-style approval step — and every endpoint is discoverable from /.well-known/oauth-authorization-server.
Tokens are audience-bound (RFC 8707): request resource=https://api.skedcast.com/v1 at the authorize step for a REST API token, or omit it for an MCP-only token.
Social media API authentication: which one should I use?#
authenticationapi-keysoauth
FAQ
- Can I use the same API key from a browser?
- No — never embed an API key in a browser, mobile app, or public repo. It grants real access to your workspace and only its SHA-256 hash is stored on SkedCast's side, so it can't be recovered if it leaks — only rotated. Use OAuth 2.1 for anything running in an untrusted client.
- How long do OAuth access tokens last?
- 15 minutes. Use the refresh token (valid 30 days, rotating on every use, reuse-detected per OAuth 2.1 §4.3.1) to get a new one. API keys are long-lived with a mandatory expiry of up to a year.
- Is this the same as a social media login API?
- Not quite — a social media login API (like "Sign in with X") authenticates a person to your own product. SkedCast's OAuth 2.1 flow instead authorizes a third-party app or AI agent to act on someone else's SkedCast workspace; it's a delegated-access model, not an end-user login button.