Authentication
One API key per tool, scoped to what that tool needs. Read keys look. Write keys can also schedule and publish.
MCP clients sign in with OAuth
claude.ai, Claude Desktop, Claude Code and Cursor do not need a key. They open a sign-in in your browser, you pick the workspace and the access level, and squidX hands them a short-lived token it refreshes on its own. See MCP server. The rest of this page is for scripts and for clients that only take a header.
Create a key
- Open the dashboard, then Settings › API and MCP access.
- Press Create key, name it after the tool that will use it (Claude Code, Zapier, weekly report), and pick an access level.
- Copy the key. It starts with
sqx_and is shown exactly once. squidX keeps a hash, never the key.
A workspace can hold up to 20 live keys. Revoking one takes effect on the next request.
Send it
Every request to https://squidx.io/api/v1 and to the MCP endpoint carries the key as a bearer token in the Authorization header. Nothing else: no query string, no cookie.
curl https://squidx.io/api/v1/me \
-H "Authorization: Bearer sqx_your_key"A missing, unknown, revoked or expired key answers 401 unauthorized. A key that exists but lacks the permission an endpoint needs answers 403 insufficient_scope.
Permissions
A permission is area:verb. Read permissions never change anything. The two write permissions are split on purpose: posts:write shapes the queue, posts:publish sends a post to X right now. You can hand an agent the first without the second.
| Permission | Allows | Read only | Read and write |
|---|---|---|---|
workspace:read | Read the workspace profile, timezone, posting slots and X connection status. | ✓ | ✓ |
posts:read | List drafts, the queue and published posts, with their metrics. | ✓ | ✓ |
posts:write | Create drafts, schedule, reschedule, cancel and delete posts. | ✓ | |
posts:publish | Send a post to X immediately. | ✓ | |
analytics:read | Read followers, impressions and engagement, and the top posts. | ✓ | ✓ |
leads:read | Read the leads your agents qualified. | ✓ | ✓ |
mentions:read | Read the replies, quotes and mentions of the connected account. | ✓ | ✓ |
The two presets in the dialog are shortcuts. Customize permissions lets you tick any subset, for example posts:read and posts:write without posts:publish: the agent can fill the queue, and a person presses Publish.
Keep it safe
- A key acts as the whole workspace, not as the person who created it. Treat it like a password: environment variables, never a repository, never a chat message.
- One key per tool. When a tool goes away, revoke its key and nothing else changes.
- Prefer a read-only key for anything that only needs to look. Add
posts:publishonly to tools you trust to press the button. - The dashboard shows when each key was last used. A key that never gets used can go.