API Key

What is an API key?

An API key is a unique credential that an API client uses to authenticate its requests to a server. The server validates the key to confirm the request comes from an authorized application or user, then either fulfills the request or rejects it. API keys serve as the digital equivalent of an ID badge — they identify the requester and (often) what permissions they have.

In the social media context, every scheduling API (CodivUpload, Buffer, Postiz, Ayrshare, Upload-Post) issues API keys to paying users. CodivUpload's keys typically follow the format `cdv_` followed by a long random string. The user passes the key in the HTTP Authorization header on every API request: `Authorization: Bearer cdv_abc123...`. The server hashes the key, looks it up in its database, finds the associated user account, and applies that account's permissions to the request.

API key vs OAuth token

Both authenticate requests, but they're used differently. API key = the developer's app-level credential (typically long-lived, manually rotated). OAuth token = a user-specific credential issued temporarily after the user explicitly grants permission to the app. In most modern social media APIs you encounter both: the developer holds an API key for their app + per-user OAuth tokens for each user who connected their account.

For scheduling APIs that abstract over OAuth (CodivUpload, Buffer), the user only sees an API key. The OAuth tokens for connected social accounts are held server-side by the scheduling service and never exposed to the developer using the scheduling API.

How to handle API keys safely

Five rules. (1) Treat API keys as secrets — never commit to version control, never log in plaintext, never paste in screenshots. (2) Use environment variables in production — `process.env.CODIVUPLOAD_API_KEY` not hardcoded strings. (3) Use a secret manager for serious production (AWS Secrets Manager, GCP Secret Manager, Doppler, Infisical). (4) Rotate periodically — quarterly is reasonable; immediately if there's any leak suspicion. (5) Use scoped or short-lived keys when possible — limits blast radius if a key is compromised.

Authenticate a CodivUpload API request with an API key

bash

# Pass the API key in the Authorization header
# Format: "Bearer <key>"

curl -X POST https://api.codivupload.com/v1/posts \
  -H "Authorization: Bearer cdv_abc123..." \
  -H "Content-Type: application/json" \
  -d '{
    "profile_name": "main",
    "platforms": ["instagram", "tiktok"],
    "post_type": "reel",
    "media_urls": ["https://cdn.example.com/video.mp4"],
    "description": "Test post",
    "tiktok_privacy_level": 0
  }'

# In Node.js with environment variable:
const apiKey = process.env.CODIVUPLOAD_API_KEY;  // never hardcode
fetch('https://api.codivupload.com/v1/posts', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${apiKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ /* ... */ })
});

Frequently asked questions