API reference · Connect
Mint connect link
POST /v1/connect-link
Mint a short-lived link to the hosted connect/manage page. Pass profile to scope the page to one tenant. Pass returnUrl to send the browser back to your app with connect_status after OAuth (the Upload-Post / Ayrshare JWT pattern). Pass platforms to show only those networks. Do not give end users POST /v1/app-link; that mints a 12-hour dashboard session.
Request
Authenticate with a bearer API key. Agents calling over MCP authorise with OAuth instead and never handle the key.
curl -X POST https://api.postlake.dev/v1/connect-link \
-H "Authorization: Bearer $POSTLAKE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"profile":"…","returnUrl":"…","platforms":["…"]}'Body
| Field | Type | Required | What it is |
|---|---|---|---|
profile | string | No | Scope the hosted page and the new connection to this profile username. Required for tenant-safe handoffs; workspace API keys still access all profiles. |
returnUrl | string | No | https callback URL without credentials or a fragment. http is allowed only for localhost. Outcome query parameters are unsigned display hints. Bind an expiring single-use state to your signed-in customer on your backend, then read their stored profile's accounts. Never authorize a tenant using the returned profile parameter. |
platforms | array of string | No | Optional non-empty allow-list enforced on connection and disconnection routes, not just page visibility. Omit for all available networks. |
Response
Success (200).
| Field | Type | Required | What it is |
|---|---|---|---|
url | string | Yes | |
expiresInSeconds | integer | Yes |
Example
{
"url": "…",
"expiresInSeconds": 0
}Limits
Write operations are limited per account, and rate-limit responses include Retry-After. Do not automatically retry a write unless this operation explicitly documents idempotency.
Calling this from an agent
This operation is part of the REST surface. Agents working over the hosted MCP server reach the same product through tools instead, and authorise with OAuth so your API key is never pasted into a chat. See the MCP server.
Errors
Every failure uses one shape: a stable type, a granular code, the field at fault in param, and a plain-language fix. An agent can act on it without a person reading the message. See Errors and retries.
Idempotency-Key.Common questions
Is it safe to retry this call?
Do not automatically repeat a write after a timeout unless that endpoint explicitly documents idempotency. First read the resulting state; a second request could repeat the action.
What happens when it fails?
You get one error shape: a stable type, a granular code you can branch on, the offending field in param, and a fix written so an agent can correct itself rather than stop. Full list on Errors and retries.