Authentication
One kind of key, what it can reach, and how to say which website you mean.
There is one way in: an API key, sent as a bearer token. No OAuth dance, no session, nothing to refresh.
Making a key
A key starts with quqi_ followed by a 40-character secret.
Sending it
A request with no bearer token comes back as 401. So does a revoked or expired one — an expired key says so in as many words, because the fix is different.
Saying which website
Send website_id on every request — as a query parameter on a GET, or in the body on a POST. You can find the ids with List your websites.
QuQi never guesses. It will not fall back to whichever website you happen to have open in the console: an unattended script would then post to whichever brand you last clicked on, which is the sort of mistake nobody notices until a customer does.
website_id at all. That is what the WordPress plugin and the Shopify app hold — they get one automatically when you pick a website while connecting.
What a key is allowed to do
A key carries permissions, and it can never do more than you can. If you are an editor on a website, a key you make cannot publish there — the key acts as you, and permissions on top of that only narrow it further.
posts:read and friends
Reading posts, articles, the calendar, channels.
Anyone on the website
posts:write, articles:write
Asking for posts and articles.
Editors and up
images:write
Making pictures.
Editors and up
posts:publish
Sending a post to a network.
Admins and owners
webhooks:manage
Adding and removing webhook endpoints.
Admins and owners
A key made before permissions existed can do everything, so nothing you already have in place stopped working.
How often you can call
120 requests a minute and 2,000 an hour, counted against the key rather than your server — so one busy script never spends another's allowance. Every response carries X-RateLimit-Remaining; going over gives you 429 and a Retry-After.
Revoking
Revoke from the same screen you made it on. It stops working on the very next request — there is no grace period, and anything holding it starts failing immediately, which is the point.