postqueen 2.0.28 has 17 commands. Every one takes -h, --help for its own flags and examples, and -v, --version prints the installed version.
Sign in
~/.postqueen/credentials.json. The token never shows up in the terminal. The CLI then appears under Connections > Approved Apps as PostQueen CLI. Each sign-in adds its own entry, and revoking the entry is what cuts the token off: postqueen auth:logout only deletes the saved login on this computer. The steps it takes are under key and login.
The key
On a machine with no browser, the CLI reads your workspace API key fromPOSTQUEEN_API_KEY instead. A workspace Admin or Super Admin copies it from Connections > API Keys.
pos_ works in POSTQUEEN_API_KEY too.
The CLI also reads two addresses:
A login saved in
~/.postqueen/credentials.json takes priority over both POSTQUEEN_API_KEY and POSTQUEEN_API_URL: the CLI then uses the token and the address in that file, and ignores the variables. postqueen auth:logout removes the file.
Posts
posts:create flags
--json file format is in posts and channels, and the settings each network needs are in examples by network.
Channels
Media and analytics
Key and login
How auth:login signs in
auth:login signs in the way MCP clients such as Claude Code and Cursor do:
- It reads the sign-in addresses from
<API>/.well-known/oauth-authorization-server/mcp-oauth-dynamic. - It registers itself as PostQueen CLI, with a callback on
127.0.0.1at a free port. - It opens the approval page with a PKCE challenge, prints the same link, and waits up to 10 minutes.
- Your browser returns to the callback. The CLI checks that the reply belongs to its own sign-in, trades the code for a token, and saves the token, the API address and the workspace ID in
~/.postqueen/credentials.json.
<API> is POSTQUEEN_API_URL, or https://api.postqueen.ai when it is unset. Because the browser returns to 127.0.0.1, the link only works in a browser on the same computer as the CLI. A backend without these routes, such as an old self-hosted version, stops it with ❌ <API> does not offer browser sign-in (HTTP 404). Use the API key there.
Every way it can fail (the server offers no sign-in, a reply that does not belong to the sign-in, a refused approval, a timeout) prints a line starting with ❌ to stderr and exits 1.
With --auth-server <url>, or with POSTQUEEN_AUTH_SERVER set, auth:login starts a device sign-in on that server instead: it asks <url>/device/code for a code, opens your browser, then asks <url>/device/token every few seconds until you approve. PostQueen runs no such server. It is only for one you run yourself, such as the one in the CLI repository’s server/ folder.
What each command prints
Most commands print one status line, then the JSON result. Drop the first line withtail -n +2 before you parse it.
posts:missing prints JSON with no status line. posts:delete prints only ✅ Post <id> deleted successfully!. auth:status and auth:logout print plain text, and auth:login prints one ❌ line on stderr.
When a command fails
A command that fails exits1 and prints its message to stderr. Only auth:status prints its result on stdout, even when it fails. What you see depends on where the command stopped:
Flag names are case-sensitive:
--startDate and --start-date both work, --startdate is an unknown argument.
Text that starts with - is text: -c "-5% off today" and -c "- a smaller size" post as written.
The API route behind each command
The CLI sends your key in theAuthorization header exactly as it is, with nothing in front of it, to these routes of the API:
auth:login calls none of these. It calls the sign-in routes above, or only the server you give it with --auth-server.
A workspace can run posts:create 30 times an hour, shared with every other script and app that uses its API, and a run the API refuses with 400 during validation, such as a missing setting, does not count. upload has its own allowance of 300 an hour. One posts:create can carry many channels, so list several IDs in -i rather than running it once per channel. The limits are on limits and errors.
Scripts and scheduled jobs
1
Give the job the key
A scheduled job does not read your shell profile, so an
export in ~/.zshrc never reaches it. Set POSTQUEEN_API_KEY in the job’s own environment. Without it the command stops with ❌ Error: No authentication found. on stderr, so send stderr to your log too (2>&1).2
Stop early on a bad key
auth:status exits 1 when no key is set or the API refuses it, so it works as the first line of the job:3
Parse only the JSON
Drop the status line with
tail -n +2, and let set -euo pipefail stop the script when a command fails.release-post.sh
crontab
Next steps
Posts and channels
The commands in use, with the campaign file format.
Troubleshooting agents
What each error means and how to fix it.