--- title: "How to create your Buffer API key" description: "To connect Buffer to an automation tool or AI assistant, you'll first need a personal API key. Your key works like a password that lets another tool act on your Buffer account, so this is the first step before building any workflow." canonical_url: "https://support.buffer.com/articles/how-to-create-your-buffer-api-key-ShIgYVwM6j" md_url: "https://support.buffer.com/articles/how-to-create-your-buffer-api-key-ShIgYVwM6j.md" --- # How to create your Buffer API key To connect Buffer to an automation tool or AI assistant, you'll first need a personal API key. Your key works like a password that lets another tool act on your Buffer account, so this is the first step before building any workflow. :::info **New to the API?** Start with [What is Buffer's API?](https://support.buffer.com/en-us/articles/what-is-buffers-api-GtIYIQilz5) for an overview of what you can build. Ready to connect a tool once your key is set up? See [Connecting Buffer to automation tools and AI assistants](https://support.buffer.com/en-us/articles/connecting-buffer-to-automation-tools-and-ai-assistants-MMoXpjDEEo). ::: ## Video: How to set up the Buffer API and your API key ## Before you start To use Buffer's API with any automation or AI assistant tool, you'll need: * ✅ **A Buffer account with a verified email address.** API access requires email verification. If you haven't verified yet, check your inbox for a verification email from Buffer, or head to your [account settings](https://publish.buffer.com/settings/account) to resend it. * ✅ **Access to the channels** you want to use. * ✅ **Your Buffer API key** (you'll create this below). * ✅ **An account with the tool you want to connect** (like Zapier or Make). ## How to create your API key 1. Click the profile icon in the lower left corner of the web dashboard. 2. Choose **API** or visit 3. Click the **Personal Access** tab if it isn't already selected. 4. In the **Keys** section, click **+ New Key**. ![Screenshot: Personal Access tab with the + New Key button highlighted](https://support.buffer.com/api/attachments.redirect?id=a59f4af2-1ab2-4347-80d1-5204d07580fb " =927x552") 5. Give your key a name (for example, "Zapier" or "n8n workflow") so you can tell your keys apart later. 6. Under **Permissions**, choose what this key is allowed to do. All permissions are ticked by default, so you can leave them as they are if you're not sure. See Choosing what your key can do below ![Screenshot: Generate API Key dialog showing the Permissions checklist with all scopes ticked](https://support.buffer.com/api/attachments.redirect?id=e262c323-7416-48bc-ac0b-9f9c004dc006 " =605x841") 7. Choose an expiration period: 7 days, 30 days, 60 days, 90 days, or 1 year. 8. Click ***Generate API Key***\*,\* then copy it and paste it into the tool you're connecting. :::tip **Tip:** For security, the dialog shows the key partially masked on screen (bullets followed by the last 4 characters). The **Copy key** button still copies the full token to your clipboard, so it's safe to take a screenshot of the masked version. Paste the copied value into the tool you're connecting. ::: ## Choosing what your key can do Every key carries a set of permissions that control what it can and can't do in your account. All of them are ticked by default, which matches how keys worked before this option existed. You need to leave at least one ticked. Unticking permissions is useful when you want a key that can do less than your full account can. For example, leave only `postsRead` ticked to create a read-only key for a reporting tool, so it can pull your post data but can't publish anything. The permissions available are: * `postsRead` and `postsWrite`: reading and creating or editing posts * `ideasRead` and `ideasWrite`: reading and creating ideas * `accountRead` and `accountWrite`: reading and updating your account details * `insightsRead`: reading post-level analytics :::info **Note:** Personal API keys can be granted every permission, including `insightsRead`. That one isn't available to third-party app clients, so if you're building something that needs access to analytics, a personal key is the way to do it. ::: ### Checking the permissions on a key you already have Each key in your list shows a permissions count beneath it, like **9 permissions**. Click it to expand and see exactly what that key can do. This is handy when you have several keys and want to check what each one is allowed to do before reusing or revoking it. It's also the first place to look if a tool connects successfully but can't perform an action you expected. ## How to confirm it worked After clicking **Generate API Key**, you should see a new key appear on the page. If you don't see one: * Refresh the page * Make sure you're in the correct organization ### Try your first API call Once your key is created, Buffer shows a prompt on the key itself offering three ways to make your first call. Pick whichever suits you, or dismiss it and come back later. * **GraphQL Query.** Copies your key and opens Buffer's API Explorer with an example already filled in, which creates an idea in your account. The quickest way to check your key works without leaving the browser. * **AI Agent.** Takes you to your integrations, where you can connect an assistant like Claude, Cursor, or ChatGPT. There's an example prompt to paste in to get started. See [Connecting Buffer to automation tools and AI assistants](https://support.buffer.com/en-us/articles/connecting-buffer-to-automation-tools-and-ai-assistants-MMoXpjDEEo). * **Terminal (CLI).** Shows the install command and a first example, for anyone who'd rather work from the command line. The **Full CLI Instructions** link goes to our developer docs. ![Buffer API key showing GraphQL Query, AI Agent, and Terminal (CLI) options](https://support.buffer.com/api/attachments.redirect?id=16f443c6-9d8e-44a2-9c07-628d770b7e1e " =894x411") ## Keep your API key secure Your API key works like a password for connecting other tools to Buffer, so only share it with trusted apps and services. * The success dialog hides most of the key on screen, so screenshots are safe. The full key is still copied when you click **Copy key**, so handle the pasted value with the same care you'd give a password. * Give each key only the permissions it actually needs. A key limited to reading data is less risky if it's ever exposed. * If you think a key has been exposed, return to your [API settings](https://publish.buffer.com/settings/api), revoke it, and generate a new one. :::info **Note:** Generating a new key in place of an existing one immediately revokes the old key. Any tools or scripts using it will stop working until you update them with the new key. ::: ## How many API keys can I create? The number of keys you can create depends on your plan: **1 on Free, 3 on Essentials, and 5 on Team**, with matching app client limits and request limits per 30 days. For the full breakdown by plan, see [What is Buffer's API?](https://support.buffer.com/en-us/articles/what-is-buffers-api-GtIYIQilz5) If you reach your plan's limit and try to create another key or app client, you'll see a prompt to upgrade. Click ***See upgrade options*** to view plans, or manage your plan from your [billing settings](https://account.buffer.com/billing). :::info **Good to knows:** * API keys are personal and tied to your user account, not your organization. * Currently, only the organization owner can create API keys. * Usage is shared across all of your personal API keys as a group. Having multiple keys gives you more flexibility, not more capacity. ::: ## API key expiration and notifications When you create a key, you choose how long it stays valid: 7 days, 30 days (default), 60 days, 90 days, or 1 year. Renew or replace a key before it expires to avoid disrupting your connected workflows. :::tip **Tip:** A longer expiration (like 1 year) is a good choice for stable, long-running integrations. ::: To help you stay ahead of expirations, Buffer sends automatic email notifications at three points: * **Key created.** A confirmation when a new key is generated, with a reminder to store it securely. * **Key expiring soon.** A heads-up before your key expires so you have time to regenerate it. * **Key expired.** A notice if a key expires, with a direct link to generate a new one. ### How to regenerate an expired key 1. In your [API settings](https://publish.buffer.com/settings/api), find the expired key. 2. Click the **⋮** menu next to it and choose ***Regenerate***. 3. Copy the new key. It will only be shown once. 4. Update the new key everywhere you used the old one: integrations, scripts, automation tools, or third-party apps. ![Screenshot of an expired key](https://support.buffer.com/api/attachments.redirect?id=a7eb5be9-226c-41cf-89fa-c78e31b982f2 " =930x174") :::info **Note:** Regenerating a key won't automatically update it in your other tools. You'll need to replace it manually wherever the old key was used. If you're not sure where that is, check any automation workflows (such as Make, n8n, or Zapier) and any custom scripts or apps that connect to Buffer. ::: ## Connecting as a third-party app (OAuth) :::tip **This section is for developers.** If you're connecting your own tools to Buffer, a personal API key is all you need. OAuth is for building an integration that accesses Buffer on behalf of *other* users without sharing credentials. ::: ### Registering your app 1. Head to **[Settings → API](https://publish.buffer.com/settings/api)**. 2. Click the **App Clients** tab. 3. Click **+ New Client**. 4. Under **Info**, fill in your app's **Name** and optionally upload a **Logo** (at least 180x180px). This is what users see when asked to approve your app. 5. Add your **Privacy Policy URL** and make sure it's publicly accessible. 6. If your app's source code is publicly accessible (for example, an open-source project, browser extension, or mobile app), check **Public client (no client secret)**. This choice is permanent and can't be changed later. 7. Under **Redirects**, add up to 5 redirect URLs. These are where Buffer sends users after they approve access. 8. Click ***Save Changes***. ![Screenshot: Buffer API New Client form showing Info, Permissions, and Redirects sections](https://support.buffer.com/api/attachments.redirect?id=f051c684-9571-41a0-a17d-b7e69adfc19c " =862x1224") :::info **Good-to-Knows** * The **Permissions** section lets you choose exactly which scopes your app needs. The consent screen only shows the permissions you select. * You can request additional scopes later by editing the client. Already-granted scopes are locked and stay granted; you can add new ones but can't remove approved ones. * Available scopes for app clients: `accountRead`, `accountWrite`, `postsRead`, `postsWrite`, `ideasRead`, `ideasWrite`. * The `insightsRead` scope (post-level analytics) is **not** available for app clients. This is a requirement of the social platforms' terms of service, which only allow a user to read their own metrics. If you need analytics access, use a personal API key instead. * The reserved OIDC scopes `openid` and `offline_access` are always included on token requests where applicable. * If you have more than one Buffer account, you can switch between them on the **Authorize** screen via ***Not you? Switch account***\*.\* ::: ### After registration Once your client is created, you'll receive a **Client ID**. If you didn't check the public client option, you'll also receive a **Client Secret**. Treat your client secret like a password and don't expose it in client-side code or public repositories. ### How OAuth works 1. Your app redirects the user to Buffer's authorization page. 2. The user approves your app's requested permissions. 3. Buffer redirects back to one of your registered redirect URLs with an authorization code. 4. Your app exchanges that code for an access token. 5. Your app uses the access token to make API requests on the user's behalf. Access tokens expire after 1 hour. Request the `offline_access` scope to also receive a refresh token for long-lived access. :::warning **Refresh tokens are single-use.** Each time you refresh, you get a new refresh token, and the one you sent becomes invalid. Reusing an old refresh token revokes every token for that grant, and your user will need to authorize your app again. Always store the most recent refresh token you receive. ::: :::info **Note:** Public clients use PKCE instead of a client secret during the token exchange. For implementation details, code examples, and error handling, see the [Buffer API authentication guide](https://developers.buffer.com/guides/authentication.html). ::: ## FAQ ### How many API keys can I have? Paid accounts can generate up to five API keys; Free accounts are limited to one. Multiple keys are useful for keeping access separate, like one key for Zapier and another for your Claude MCP setup. See [What is Buffer's API?](https://support.buffer.com/en-us/articles/what-is-buffers-api-GtIYIQilz5) for the full breakdown by plan. ### Can I make a key that can only read data, not post? Yes. When you create a key, untick the write permissions and leave only the read ones (like `postsRead`) ticked. This is a good option for reporting tools or anything you want to be certain can't publish on your behalf. You can check any existing key's permissions by clicking the permissions count beneath it in your [API settings](https://publish.buffer.com/settings/api). ### What happens if I downgrade my plan? If you downgrade to Free while holding multiple keys, all keys except your original (earliest-created) one are automatically revoked. You'll be notified so you can update any affected integrations first. ### Does API usage count separately for each key? It depends on the type. **Personal API keys** share a single usage pool, so more keys don't mean more capacity. **App clients** (OAuth integrations) each have their own separate limits. You can see the breakdown in your [API settings](https://publish.buffer.com/settings/api). ### Can I name my API keys? Yes. When generating a key, you can give it an optional name (like "Make automation" or "Claude MCP"), which makes it easier to manage multiple keys and know which to revoke if something stops working. ### How do I revoke an API key? On the API settings page, click the **⋮** (three-dot menu) next to any key and choose **Revoke**. If you think a key has been compromised, revoke it and generate a new one right away. :::info Need help with the API? Send us an email at [hello@buffer.com,](mailto\:hello@buffer.com) and our Advocacy team will be standing by to assist! :::