Authentication

# GitHub Actions secret
gh secret set PUBLORA_API_KEY

# AWS Secrets Manager
aws secretsmanager create-secret --name postpost-api-key --secret-string "sk_..."

# Kubernetes secret
kubectl create secret generic postpost --from-literal=api-key="sk_..."

sk_kzq5mjw_a1b2c3d4e5f6g7h8i9j0.k1l2m3n4o5p6...

function isValidPostPostKey(key) {
  if (!key || typeof key !== 'string') return false;
  if (!key.startsWith('sk_')) return false;
  if (key.length < 20) return false;
  return true;
}

// Usage
const apiKey = process.env.PUBLORA_API_KEY;
if (!isValidPostPostKey(apiKey)) {
  throw new Error('Invalid PUBLORA_API_KEY format. Key must start with sk_');
}

def is_valid_postpost_key(key):
    """Validate PostPost API key format."""
    if not key or not isinstance(key, str):
        return False
    if not key.startswith('sk_'):
        return False
    if len(key) < 20:
        return False
    return True

# Usage
api_key = os.environ.get('PUBLORA_API_KEY')
if not is_valid_postpost_key(api_key):
    raise ValueError('Invalid PUBLORA_API_KEY format. Key must start with sk_')

curl https://api.postpost.dev/api/v1/platform-connections \
  -H "x-api-key: sk_kzq5mjw_a1b2c3d4e5f6.7h8i9j0k..."

const response = await fetch('https://api.postpost.dev/api/v1/platform-connections', {
  headers: {
    'x-api-key': process.env.PUBLORA_API_KEY
  }
});

response = requests.get(
    'https://api.postpost.dev/api/v1/platform-connections',
    headers={'x-api-key': os.environ['PUBLORA_API_KEY']}
)

{
  "mcpServers": {
    "postpost": {
      "type": "http",
      "url": "https://mcp.postpost.dev",
      "headers": {
        "Authorization": "Bearer sk_kzq5mjw_a1b2c3d4e5f6.7h8i9j0k..."
      }
    }
  }
}

# Add to ~/.bashrc or ~/.zshrc
export PUBLORA_API_KEY="sk_kzq5mjw_a1b2c3d4e5f6.7h8i9j0k..."

# .env
PUBLORA_API_KEY=sk_kzq5mjw_a1b2c3d4e5f6.7h8i9j0k...

async function verifyAuthentication() {
  const apiKey = process.env.PUBLORA_API_KEY;

  // Validate format first
  if (!apiKey?.startsWith('sk_')) {
    console.error('Error: API key must start with sk_');
    console.error('Get your key at: https://postpost.dev → API');
    return false;
  }

  try {
    const response = await fetch('https://api.postpost.dev/api/v1/platform-connections', {
      headers: { 'x-api-key': apiKey }
    });

    if (response.status === 401) {
      console.error('Error: Invalid API key');
      console.error('Check your key or generate a new one at postpost.dev');
      return false;
    }

    if (!response.ok) {
      console.error(`Error: HTTP ${response.status}`);
      return false;
    }

    const data = await response.json();
    console.log(`✓ Authenticated successfully`);
    console.log(`✓ ${data.connections.length} connected platform(s)`);
    return true;
  } catch (error) {
    console.error('Error: Connection failed -', error.message);
    return false;
  }
}

import os
import requests

def verify_authentication():
    """Verify API key is valid and working."""
    api_key = os.environ.get('PUBLORA_API_KEY')

    # Validate format first
    if not api_key or not api_key.startswith('sk_'):
        print('Error: API key must start with sk_')
        print('Get your key at: https://postpost.dev → API')
        return False

    try:
        response = requests.get(
            'https://api.postpost.dev/api/v1/platform-connections',
            headers={'x-api-key': api_key}
        )

        if response.status_code == 401:
            print('Error: Invalid API key')
            print('Check your key or generate a new one at postpost.dev')
            return False

        response.raise_for_status()
        data = response.json()
        print(f'✓ Authenticated successfully')
        print(f"✓ {len(data['connections'])} connected platform(s)")
        return True

    except requests.RequestException as e:
        print(f'Error: Connection failed - {e}')
        return False

# Run verification
verify_authentication()

// After verification succeeds, make API calls
const response = await fetch('https://api.postpost.dev/api/v1/list-posts', {
  headers: { 'x-api-key': process.env.PUBLORA_API_KEY }
});
const { posts } = await response.json();
console.log(`Found ${posts.length} posts`);

const response = await fetch('https://api.postpost.dev/api/v1/create-post', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-api-key': process.env.PUBLORA_API_KEY,
    'x-postpost-user-id': '507f1f77bcf86cd799439011'  // Managed user (must have parentUser set to key owner)
  },
  body: JSON.stringify({
    content: 'Posted on behalf of managed user',
    platforms: ['twitter-123456']
  })
});

async function postpostRequest(endpoint, options = {}) {
  const apiKey = process.env.PUBLORA_API_KEY;

  if (!apiKey?.startsWith('sk_')) {
    throw new Error('PUBLORA_API_KEY not set or invalid format');
  }

  const response = await fetch(`https://api.postpost.dev/api/v1${endpoint}`, {
    ...options,
    headers: {
      'x-api-key': apiKey,
      'Content-Type': 'application/json',
      ...options.headers
    }
  });

  if (response.status === 401) {
    throw new Error('Invalid API key. Generate a new one at postpost.dev → API');
  }

  if (response.status === 403) {
    const data = await response.json();
    if (data.error?.includes('API access is not enabled')) {
      throw new Error('API access not enabled. Upgrade at postpost.dev/pricing');
    }
    throw new Error(data.error || 'Access denied');
  }

  if (!response.ok) {
    const data = await response.json();
    throw new Error(data.error || `HTTP ${response.status}`);
  }

  return response.json();
}

class PostPostAuthError(Exception):
    """Raised when authentication fails."""
    pass

def postpost_request(endpoint, method='GET', **kwargs):
    """Make authenticated request with proper error handling."""
    api_key = os.environ.get('PUBLORA_API_KEY')

    if not api_key or not api_key.startswith('sk_'):
        raise PostPostAuthError('PUBLORA_API_KEY not set or invalid format')

    response = requests.request(
        method,
        f'https://api.postpost.dev/api/v1{endpoint}',
        headers={
            'x-api-key': api_key,
            'Content-Type': 'application/json'
        },
        **kwargs
    )

    if response.status_code == 401:
        raise PostPostAuthError('Invalid API key. Generate a new one at postpost.dev → API')

    if response.status_code == 403:
        data = response.json()
        if 'API access is not enabled' in data.get('error', ''):
            raise PostPostAuthError('API access not enabled. Upgrade at postpost.dev/pricing')
        raise PostPostAuthError(data.get('error', 'Access denied'))

    response.raise_for_status()
    return response.json()

async function postpostRequestWithRetry(endpoint, options = {}, maxRetries = 3) {
  const apiKey = process.env.PUBLORA_API_KEY;

  if (!apiKey?.startsWith('sk_')) {
    throw new Error('PUBLORA_API_KEY not set or invalid format');
  }

  for (let attempt = 1; attempt <= maxRetries; attempt++) {
    try {
      const response = await fetch(`https://api.postpost.dev/api/v1${endpoint}`, {
        ...options,
        headers: {
          'x-api-key': apiKey,
          'Content-Type': 'application/json',
          ...options.headers
        }
      });

      // Don't retry auth errors - they won't succeed
      if (response.status === 401 || response.status === 403) {
        const data = await response.json();
        throw new Error(data.error || `Auth error: ${response.status}`);
      }

      // Retry on rate limit
      if (response.status === 429) {
        const retryAfter = parseInt(response.headers.get('Retry-After') || '60');
        console.log(`Rate limited. Waiting ${retryAfter}s...`);
        await new Promise(r => setTimeout(r, retryAfter * 1000));
        continue;
      }

      // Retry on server errors
      if (response.status >= 500 && attempt < maxRetries) {
        const delay = Math.pow(2, attempt) * 1000;
        console.log(`Server error. Retry ${attempt}/${maxRetries} in ${delay}ms...`);
        await new Promise(r => setTimeout(r, delay));
        continue;
      }

      if (!response.ok) {
        const data = await response.json();
        throw new Error(data.error || `HTTP ${response.status}`);
      }

      return response.json();
    } catch (error) {
      if (attempt === maxRetries) throw error;
      if (error.message.includes('Auth error')) throw error; // Don't retry auth errors
    }
  }
}

// Good: Environment variable
const apiKey = process.env.PUBLORA_API_KEY;

// Bad: Hardcoded
const apiKey = 'sk_kzq5mjw_a1b2c3d4e5f6.7h8i9j0k...'; // Never do this!