The REST API is on every plan, including Free — there is no automation tier and no per-call add-on. With it you can:
- Manage spaces and connected social accounts
- Create, schedule, update, retry, and delete posts
- Upload and manage media
- Configure recurring slots and inspect the upcoming queue
- Read per-account analytics
- Manage subscriptions, link-in-bio pages, and webhook endpoints
Connecting a new social account stays in the browser, because the platform OAuth flow needs one. Everything else is available programmatically.
Create a token
Every request is authenticated with a personal access token, tied to your user account.
- Sign in and open Settings → API tokens.
- Choose Create token and give it a descriptive name —
local-dev, or the name of the automation using it. - Copy the token straight into a password manager or secret store.
The token is shown once, right after you create it. If you lose it, revoke it and create another — it cannot be shown again.
Treat it like a password: it carries every permission its owner has, in every space they belong to. Never commit one to source control or ship it in client-side code — load it from an environment variable or a secrets manager instead. The same Settings page shows when each token was last used and revokes any of them instantly.
Make your first request
Send the token as a Bearer token in the Authorization header:
export ZILFU_API_TOKEN="your-token-here"
curl https://zilfu.app/api/spaces \
-H "Authorization: Bearer $ZILFU_API_TOKEN" \
-H "Accept: application/json"
That returns the spaces you have access to. Each space holds its own accounts, posts, slots, and timezone, and almost every other endpoint is scoped to one — so this is the call that gives you the {space} id the rest of the API needs.
Where to go next
- Rate limits — the ceilings, the headers, and how to back off.
- API reference — every endpoint, with request and response shapes.
- What is MCP? — the same token, driven by an AI assistant instead of a script.