The Pallyy API is a REST API served over HTTPS. Every endpoint lives under a single base URL:
https://app.pallyy.com/api/v1
All requests are authenticated with an API key. Requests without a valid key receive a 401 response.
AI assistants connected through the MCP server authenticate with OAuth access tokens instead. Those start with pallyy_oat_, are accepted by every endpoint on this page, and follow the same scope and social set rules as a key.
API keys
API keys are created from Settings > API Keys in your Pallyy account and always start with the pallyy_ prefix. The full key is only shown once, when it is created, so store it somewhere safe. If you lose a key, revoke it and create a new one.
A few things to know about keys:
- You can have up to 10 active keys per account.
- Each key has a name, a set of scopes, and an optional social set restriction. All three can be changed after the key is created.
- Keys can be disabled or revoked at any time by opening them from the API keys list. Disabling is reversible, revoking is permanent. Requests with a disabled or revoked key receive a
401with the error codeapi-key:invalid.
Authenticating requests
Pass your key as a bearer token in the Authorization header:
curl https://app.pallyy.com/api/v1/social-sets \
-H "Authorization: Bearer pallyy_your_api_key"
Requests that send a body must also set Content-Type: application/json.
Scopes
Every valid key can read. Scopes only gate writes: a key with no scopes is read-only. The "In the app" column is the label each scope carries when you create or edit a key in Pallyy.
| Scope | In the app | Grants |
|---|---|---|
post-sets:write | Edit posts | Create and update post sets |
post-sets:publish | Publish posts | Required on top of post-sets:write to create or update post sets with status SCHEDULED, meaning posts that will actually publish |
media:write | Upload media | Create media uploads |
notes:write | Edit notes | Create and update notes on the calendar |
Calling a write endpoint with a key that is missing the required scope returns a 403 with the error code api-key:missing_scope.
The split between post-sets:write and post-sets:publish exists so you can hand out keys that draft content without being able to publish it. A key with only post-sets:write (Edit posts) can create and update drafts, but any attempt to schedule requires post-sets:publish (Publish posts).
Social set restrictions
A key can be restricted to one or more social sets. A restricted key:
- Only sees its allowed sets when listing social sets.
- Can only read and write resources that belong to those sets.
Resources outside the restriction are reported as 404.
A key with no restriction has access to all of the account's social sets.
More in Getting started
Questions about the API? Email us at hey@pallyy.com and we'll get back to you.