Authentication
The Foxli API uses account-level Bearer tokens. One key gives your integration access to every workspace you own or administer, acting with your user permissions.
API keys and prefixes
Pass your secret key in the standard Authorization request header. Never transmit API keys in query parameters or URL paths.
curl https://api.foxli.app/v1/me \
-H "Authorization: Bearer fx_live_8a92fb4c71e29..."
Live production keys
Executes live actions: schedules and publishes actual posts to connected social networks.
Test sandbox keys
Permits verifying your integration, generating draft records, and triggering test webhooks without publishing.
Permission scopes (7)
Each key can be restricted to only the permissions your application requires. Requests that attempt an action outside the key's assigned scopes return 403 insufficient_scope.
| Scope | Capabilities | Authorized endpoints |
|---|---|---|
workspaces:read | Read workspace settings, details, and team member lists. | GET /v1/workspaces, GET /v1/workspaces/{id}/members |
workspaces:write | Create new workspaces or update workspace timezone and settings. | POST /v1/workspaces, PATCH /v1/workspaces/{id} |
posts:read | List posts, inspect post details, drafts, queued items, and channel delivery results. | GET /v1/posts, GET /v1/posts/{id} |
posts:write | Create, schedule, edit, or delete posts, and import external media files to Foxli CDN. | POST /v1/posts, PATCH /v1/posts/{id}, DELETE /v1/posts/{id}, POST /v1/media |
channels:read | List all social media accounts connected to the workspace. | GET /v1/channels |
analytics:read | Read aggregate impressions, follower growth, engagement rates, and daily time series. | GET /v1/analytics/overview |
webhooks:manage | Subscribe webhook URLs to post lifecycle events, view existing subscriptions, and test signatures. | GET /v1/webhooks, POST /v1/webhooks, DELETE /v1/webhooks/{id}, POST /v1/webhooks/{id}/test |
Choosing a workspace
Foxli organizes channels, schedules, and media into workspaces. Since your API key operates at the account level, you tell Foxli which workspace to act on.
Foxli-Workspace: <workspace_id> header on every workspace request. You can find your workspace IDs from GET /v1/workspaces or step 2 of Quickstart. Omission returns 400 workspace_required.Key security and rotation
API keys hold full publishing power across your social networks. Follow these operational guidelines:
- Store keys exclusively in backend server environments (e.g. AWS Secrets Manager, Doppler, GCP Secret Manager, or
.envon servers). - Never commit keys to public or private Git repositories, or embed them in browser JavaScript or mobile applications.
- Rotate keys regularly. You can have multiple active keys simultaneously, allowing seamless zero-downtime rotation.
- Revoke compromised or retired keys immediately from the Foxli dashboard. Revocation takes effect instantaneously (`401 invalid_api_key`).
Plan requirements
API access is included with all active Creator and Team subscriptions (as well as during active 30-day trials). Free accounts do not include public API access. Attempting to call the API from a Free tier account returns 403 insufficient_plan.