Postlane API & MCP connector

Give an AI agent full control of your workspace.

A scoped REST API and a Model Context Protocol (MCP) server let agents like Claude publish, schedule, moderate the inbox, read analytics and manage your channels — with the same permissions and approval rules your team uses. Connect in one click with OAuth, or generate a long-lived API key.

RESTMCPOAuth 2.1 + PKCEWebhooks

Base URLs

REST API	`https://vhludoussbmvvjxtywwm.supabase.co/functions/v1/api-v1`
OpenAPI spec	`…/api-v1/openapi.json`
MCP server	`https://postlane.me/mcp`
OAuth metadata	`https://postlane.me/.well-known/oauth-authorization-server`

Every write accepts an Idempotency-Key header so retries are safe. Rate limit is plan-tiered (default 60 req/min per key; MCP bursts get more headroom).

Authentication

API key (server-to-server)

Create a key in Settings › API. It is shown once. Send it as a bearer token:

# any REST call
curl …/api-v1/account \
  -H "Authorization: Bearer tddy_…"

OAuth 2.1 (one-click for agents)

Agents that support OAuth (like claude.ai custom connectors) register dynamically and get a short-lived oat_ token after you approve the consent screen. Nothing to copy-paste.

# discovery is automatic:
GET /.well-known/oauth-authorization-server
# authorization-code + PKCE (S256), refresh tokens

Scopes & mode

Each credential carries scopes — read publish community manage — and a mode. In review mode every post an agent creates is queued as pending_approval for a human; in full mode its actions go live directly.

Connect Claude in one click

In Claude (Settings → Connectors → Add custom connector), paste the MCP URL: https://postlane.me/mcp
Claude discovers the OAuth server and opens Postlane's consent screen. Sign in and choose the permissions and mode (start with review).
Approve. Claude receives a scoped token and the tools appear — get_account_usage, create_post, list_conversations, and more.
Ask Claude to work: “Draft this week's posts from our brand profile and queue them for approval.”

Prefer a key? Claude Desktop / API

Point any MCP client at the server with a bearer key:

{
  "mcpServers": {
    "postlane": {
      "url": "https://postlane.me/mcp",
      "headers": { "Authorization": "Bearer tddy_…" }
    }
  }
}

The MCP server also exposes read-only resources (brand profile, account, channels) so the agent can pull context without a tool call.

Endpoints

Method & path	Scope	What it does
GET /account	read	Workspace, plan, limits and live usage
GET /channels	read	Connected social channels
GET\|POST /posts	read/publish	List or create posts (draft, scheduled, pending_approval)
GET\|PATCH\|DELETE /posts/:id	read/publish	Read, edit or delete a post (+ its latest publish job/error)
POST /posts/:id/publish	publish	Publish now (queued for the runner)
POST /posts/:id/approve · /reject	manage	Decide a pending post (full mode only)
POST · DELETE /media	publish	Upload (URL or base64) / delete media
GET\|POST /ideas · PATCH\|DELETE /ideas/:id	read/manage	Ideas board CRUD
GET\|POST /tags	read/manage	Content tags
GET /posting-slots	read	Preferred posting times per channel
GET /metrics · /post-metrics	read	Daily channel metrics; per-post performance
GET /analytics/summary	read	Aggregated KPIs over N days
GET /reports · /report-schedules	read	Saved reports and scheduled deliveries
GET /conversations · /conversations/:id	read	Community inbox + message history
PATCH /conversations/:id	community	Set status (open/assigned/resolved/…)
POST /conversations/:id/reply · like · hide	community	Act on the native platform
GET /saved-replies · /brand-profile	read	Canned replies; AI brand voice & rules
GET /members · /notifications	read	Team members; recent in-app notifications
GET\|POST /webhooks · DELETE /webhooks/:id	manage	Outbound signed webhooks

Full request/response shapes are in the OpenAPI spec. GET /api-v1/ lists every route.

Webhooks

Register an HTTPS endpoint to receive signed events: post.published, post.failed, conversation.created. Verify each delivery with the HMAC signature:

X-Postlane-Signature: sha256=HMAC_SHA256(rawBody, endpointSecret)

Deliveries retry up to 3 times with backoff on network errors and 5xx; every attempt is logged and readable via GET /webhooks/:id/deliveries.

Create your key View OpenAPI