Getting started
Authentication
API keys
Create keys in the dashboard under Settings → API keys. A key looks like rb_live_3n9Xk…. We show it exactly once and only store a salted hash, so copy it into your secret manager right away. If you lose a key, revoke it and create a new one.
Keys can have an optional expiry date and can be revoked at any time; revocation takes effect immediately.
Making requests
Send the key in the Authorization header on every request. All endpoints live under https://reblogger.ai/api/v1 and require HTTPS.
curl https://reblogger.ai/api/v1/account \
-H "Authorization: Bearer $REBLOGGER_API_KEY"A missing, malformed, expired or revoked key returns 401:
{
"type": "https://reblogger.ai/docs/api/errors#invalid_api_key",
"title": "invalid_api_key",
"status": 401,
"detail": "The API key is invalid, expired or revoked.",
"instance": "/api/v1/account"
}Scopes
New keys get all scopes by default. Restrict a key to what an integration needs — for example a reporting job only needs articles:read.
| Scope | Grants |
|---|---|
articles:read | List and read articles and generations, stream events, list models, extract URLs, list webhooks. |
articles:write | Create, edit and delete articles; cancel generations; create and delete webhook endpoints. |
account:read | Read your plan, credit balance and features (GET /account). |
Calling an endpoint without the required scope returns 403 insufficient_scope. Each endpoint's scope is listed in the API reference.
Site-scoped keys
When you connect a WordPress site, reblogger creates a dedicated key bound to that site. Articles created with it are attributed to the site, and disconnecting the plugin revokes only that key. See WordPress plugin.
Keeping keys safe
- Treat keys like passwords. Keep them on your server, in environment variables or a secret manager — never in client-side code or a Git repository.
- Use one key per integration so you can rotate or revoke them independently. The dashboard shows when each key was last used.
- Rotate a key by creating the new one, deploying it, then revoking the old one — there is no downtime.
Never ship a key to the browser
The API sends permissive CORS headers so you can prototype quickly, but anyone who can read your page can read an embedded key and spend your credits. Proxy requests through your own backend instead.
Plans and access
The API and the MCP server are available on every plan, including Free. Some options depend on your plan — premium models, long and pillar lengths, the number of images, brand voices, webhooks and EU data residency. If a request needs something your plan doesn't include, you get 403 plan_required with the missing feature in the body. Models and credits explains what each plan unlocks.