The REST API is on every plan, including Free — there is no automation tier and no per-call add-on. With it you can:
- Manage spaces and connected social accounts
- Create, schedule, update, retry, and delete posts
- Upload and manage media
- Configure recurring slots and inspect the upcoming queue
- Read per-account analytics
- Manage subscriptions, link-in-bio pages, and webhook endpoints
Connecting a new social account stays in the browser, because the platform OAuth flow needs one. Everything else is available programmatically.
Find your API key
Every request is authenticated with a token tied to your user account, and your account already has one.
- Sign in and open Settings → REST APIs.
- Choose Reveal to read the key, or Copy to take it without showing it.
The same key authenticates the REST API, the MCP server, and the CLI — there is nothing to create first, and nothing to keep in step.
Treat it like a password: it carries every permission you have, in every space you belong to. Never commit it to source control or ship it in client-side code — load it from an environment variable or a secrets manager instead.
Rotate replaces the key and kills the old one on the spot. Do it the moment a key leaks, and expect every agent, script, and CLI login still holding the old one to start failing.
Extra tokens
Under Additional tokens you can mint as many separate tokens as you like — one per machine, per CI job, per script. They carry the same access as the key and are revoked one at a time, which is the point of them: pulling a build server's token leaves everything else running. Unlike the key, an extra token is shown once and cannot be revealed again.
Make your first request
Send the token as a Bearer token in the Authorization header:
export ZILFU_API_TOKEN="your-token-here"
curl https://zilfu.app/api/spaces \
-H "Authorization: Bearer $ZILFU_API_TOKEN" \
-H "Accept: application/json"
That returns the spaces you have access to. Each space holds its own accounts, posts, slots, and timezone, and almost every other endpoint is scoped to one — so this is the call that gives you the {space} id the rest of the API needs.
Where to go next
- Rate limits — the ceilings, the headers, and how to back off.
- API reference — every endpoint, with request and response shapes.
- What is MCP? — the same key, driven by an AI assistant instead of a script.