Skip to main content
postqueen 2.0.28 has 17 commands. Every one takes -h, --help for its own flags and examples, and -v, --version prints the installed version.

Sign in

The CLI opens PostQueen’s sign-in page in your browser. A workspace Admin or Super Admin approves it, and the CLI saves the token and the API address in ~/.postqueen/credentials.json. The token never shows up in the terminal. The CLI then appears under Connections > Approved Apps as PostQueen CLI. Each sign-in adds its own entry, and revoking the entry is what cuts the token off: postqueen auth:logout only deletes the saved login on this computer. The steps it takes are under key and login.

The key

On a machine with no browser, the CLI reads your workspace API key from POSTQUEEN_API_KEY instead. A workspace Admin or Super Admin copies it from Connections > API Keys.
An OAuth access token that starts with pos_ works in POSTQUEEN_API_KEY too. The CLI also reads two addresses: A login saved in ~/.postqueen/credentials.json takes priority over both POSTQUEEN_API_KEY and POSTQUEEN_API_URL: the CLI then uses the token and the address in that file, and ignores the variables. postqueen auth:logout removes the file.

Posts

posts:create flags

The --json file format is in posts and channels, and the settings each network needs are in examples by network.

Channels

Media and analytics

Two letters mean different things in different commands. -s is --date on posts:create and --status on posts:status. -d is minutes (--delay) on posts:create, days (--date) on the analytics commands, and JSON input (--data) on integrations:trigger.

Key and login

How auth:login signs in

auth:login signs in the way MCP clients such as Claude Code and Cursor do:
  1. It reads the sign-in addresses from <API>/.well-known/oauth-authorization-server/mcp-oauth-dynamic.
  2. It registers itself as PostQueen CLI, with a callback on 127.0.0.1 at a free port.
  3. It opens the approval page with a PKCE challenge, prints the same link, and waits up to 10 minutes.
  4. Your browser returns to the callback. The CLI checks that the reply belongs to its own sign-in, trades the code for a token, and saves the token, the API address and the workspace ID in ~/.postqueen/credentials.json.
<API> is POSTQUEEN_API_URL, or https://api.postqueen.ai when it is unset. Because the browser returns to 127.0.0.1, the link only works in a browser on the same computer as the CLI. A backend without these routes, such as an old self-hosted version, stops it with ❌ <API> does not offer browser sign-in (HTTP 404). Use the API key there. Every way it can fail (the server offers no sign-in, a reply that does not belong to the sign-in, a refused approval, a timeout) prints a line starting with ❌ to stderr and exits 1. With --auth-server <url>, or with POSTQUEEN_AUTH_SERVER set, auth:login starts a device sign-in on that server instead: it asks <url>/device/code for a code, opens your browser, then asks <url>/device/token every few seconds until you approve. PostQueen runs no such server. It is only for one you run yourself, such as the one in the CLI repository’s server/ folder.

What each command prints

Most commands print one status line, then the JSON result. Drop the first line with tail -n +2 before you parse it. posts:missing prints JSON with no status line. posts:delete prints only ✅ Post <id> deleted successfully!. auth:status and auth:logout print plain text, and auth:login prints one ❌ line on stderr.

When a command fails

A command that fails exits 1 and prints its message to stderr. Only auth:status prints its result on stdout, even when it fails. What you see depends on where the command stopped: Flag names are case-sensitive: --startDate and --start-date both work, --startdate is an unknown argument. Text that starts with - is text: -c "-5% off today" and -c "- a smaller size" post as written.

The API route behind each command

The CLI sends your key in the Authorization header exactly as it is, with nothing in front of it, to these routes of the API: auth:login calls none of these. It calls the sign-in routes above, or only the server you give it with --auth-server. A workspace can run posts:create 30 times an hour, shared with every other script and app that uses its API, and a run the API refuses with 400 during validation, such as a missing setting, does not count. upload has its own allowance of 300 an hour. One posts:create can carry many channels, so list several IDs in -i rather than running it once per channel. The limits are on limits and errors.

Scripts and scheduled jobs

1

Give the job the key

A scheduled job does not read your shell profile, so an export in ~/.zshrc never reaches it. Set POSTQUEEN_API_KEY in the job’s own environment. Without it the command stops with ❌ Error: No authentication found. on stderr, so send stderr to your log too (2>&1).
2

Stop early on a bad key

auth:status exits 1 when no key is set or the API refuses it, so it works as the first line of the job:
3

Parse only the JSON

Drop the status line with tail -n +2, and let set -euo pipefail stop the script when a command fails.
release-post.sh
crontab

Next steps

Posts and channels

The commands in use, with the campaign file format.

Troubleshooting agents

What each error means and how to fix it.
Last modified on October 15, 2026