Postscript Authentication

generated: '2026-08-13'
method: searched
source: https://developers.postscript.io/docs/api-authentication
docs: https://developers.postscript.io/docs/api-authentication
spec_source: openapi/_original/postscript-partner-api-openapi.yml
provider: Postscript
api: Postscript Partner API v2
summary:
  types:
  - apiKey
  api_key_in:
  - header
  oauth2_flows: []
  oauth: false
  note: >-
    Static private API keys only. Postscript operates no OAuth or OpenID Connect surface — every
    /.well-known/openid-configuration and /.well-known/oauth-authorization-server probe returned 404
    (postscript.io, developers.postscript.io, app.postscript.io) or 401 (api.postscript.io) on
    2026-08-13, and no authorization or token endpoint appears anywhere in the documentation. There
    is therefore no scope model and no scopes/ artifact for this provider.
schemes:
- name: sec0
  type: apiKey
  in: header
  parameter: Authorization
  format: 'Bearer <private_api_key>'
  description: >-
    The private API key of the calling identity, sent as a bearer token. Declared as an apiKey scheme
    with x-bearer-format bearer in Postscript's own published OpenAPI fragments rather than as an
    http/bearer scheme.
  sources:
  - openapi/postscript-compliance-api-openapi.yml
  - openapi/postscript-events-api-openapi.yml
  - openapi/postscript-identity-api-openapi.yml
  - openapi/postscript-keywords-api-openapi.yml
  - openapi/postscript-messages-api-openapi.yml
  - openapi/postscript-subscribers-api-openapi.yml
  - openapi/postscript-webhooks-api-openapi.yml
- name: X-Postscript-Shop-Token
  type: apiKey
  in: header
  parameter: X-Postscript-Shop-Token
  description: >-
    Delegation header. A partner acting on behalf of a Shopify shop sends its own partner key in
    Authorization and that shop's private key here. Shops calling for themselves omit it. It is
    declared as an operation-level header parameter on all twenty published operations rather than as
    a securityScheme, so a generic OpenAPI-driven client will not treat it as credential material.
  required_for: partners
  sources:
  - openapi/_original/postscript-partner-api-openapi.yml
identities:
- role: shop
  key_type: private API key
  key_prefix: sk_
  obtained_from: https://app.postscript.io/account/api
  note: >-
    Shops generate a Security Key Pair in the Postscript dashboard. The PUBLIC key (pk_ prefix) is
    not valid for API authorization — only the private key is.
- role: partner
  key_type: private partner API key
  key_prefix: sk_partner_
  obtained_from: https://dash.partnerstack.com/application?company=postscript&group=partnerpending
  note: >-
    Partner keys are issued by the Postscript team through the partner application, not self-serve.
    Trigger management needs the partner key alone; anything acting on a shop's data also needs that
    shop's key in X-Postscript-Shop-Token.
legacy:
  scheme: http basic
  supported: true
  format: 'Authorization: Basic base64(<private_api_key>:)'
  note: Username is the private API key, password is empty. Still supported alongside bearer.
verification_endpoint:
  operation: verify-identity
  path: GET /api/v2/me
  description: Returns the identity a token resolves to, letting a caller confirm which shop or partner it is acting as.
key_management:
  rotation: Shops can regenerate their Security Key Pair from the dashboard.
  revocation_note: >-
    Rotating a shop's keys used to invalidate v1 object identifiers, which is why v2 introduced
    prefixed ids decoupled from the key pair.
  expiry: none published
  scopes: none
security_guidance:
  from_provider: >-
    Postscript explicitly warns against calling the API from a browser/front-end because the private
    key cannot be hidden there, and recommends proxying through your own backend or an intermediary
    such as Zapier.
  transport: HTTPS only; api.postscript.io answered TLS 1.3 on probe, with no HSTS header set.
access_gating:
  note: >-
    Since April 2022, custom API access for an individual shop requires an enterprise plan (shops
    with access before that date are grandfathered). Shops on any plan may still generate keys for
    use with approved Integration Partners, and Integration Partners keep full API access regardless
    of the shop's plan.
  source: https://developers.postscript.io/docs/who-has-access-to-the-partner-api