Can an API key bypass the approval rule?

No. The web app, the REST API and the MCP server share one service layer, so a key on a brand that requires approval cannot schedule an unapproved revision.

One brand. A key belongs to the workspace it was created in and carries a read, write or admin scope that is checked on every call. Another brand's data is never returned.

Automation and troubleshooting

The API and the MCP server

Everything you can do in PlanSend, a script or an AI assistant can do too, under exactly the same approval rules. The full reference lives on the developers page; this is the short version.

Create a key

Open Developers in the sidebar. Only owners can create keys.
Select Create key and choose a scope: read, write or admin.
Copy the token. It is shown once and stored only as a hash.

Keys belong to one brand. Revoke one at any time from the same page, where you can also see when each key was last used.

The REST API

Send the key as a bearer token to /api/v1. It covers channels, media, posts and their per-channel versions, review links, approvals, scheduling, cancellation, publishing jobs and AI Assist. Errors come back with a stable code, so a script can tell an expired revision from a plan limit.

The MCP server

The same key works with PlanSend's built-in Model Context Protocol server at /mcp, so an assistant such as Claude can draft a post, ask your client for approval and schedule the approved version, without you writing any glue code. The read tools are marked read-only, so an assistant cannot publish by accident.

Full reference

Every endpoint, every MCP tool, the scope each one needs, worked request and response examples, the error table and copy-ready configuration for Claude Code, Claude Desktop, Cursor and curl are on the developers page. It is kept in step with the code, so it is the place to check rather than this article.

Limits

Each key is limited to 120 requests a rolling minute. AI Assist through the API draws on the same monthly credits as the composer. Both the API and MCP are included in every plan, Free included.

Common questions

Can an API key bypass the approval rule?: No. The web app, the REST API and the MCP server share one service layer, so a key on a brand that requires approval cannot schedule an unapproved revision.
What can a key see?: One brand. A key belongs to the workspace it was created in and carries a read, write or admin scope that is checked on every call. Another brand's data is never returned.

Still stuck? Email [email protected].