> ## Documentation Index > Fetch the complete documentation index at: https://docs.postqueen.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > PostQueen's hosted API is https://api.postqueen.ai. The public API base is https://api.postqueen.ai/public/v1 and takes the raw API key in the Authorization header, with no Bearer prefix. > The MCP server for posting is https://api.postqueen.ai/mcp/YOUR_API_KEY (or /mcp with Authorization: Bearer YOUR_API_KEY). docs.postqueen.ai/mcp only searches these docs and cannot post. > The API key is under Connections > API Keys in the app, and only workspace admins can see it. # Register a client > Let a client register itself and get a pcd_ client id, without an app under Connections > Developers. Most integrations never call this. An MCP client that supports OAuth sign-in calls it on its own when you add PostQueen by its sign-in address. Call it yourself only when you build a client that registers itself (Dynamic Client Registration, RFC 7591). The answer carries a `pcd_` client id. A public client (`token_endpoint_auth_method: none`) gets no secret, so it must use PKCE with `S256` on the [consent URL](/public-api/oauth/authorize) and send the `code_verifier` in the [token exchange](/public-api/oauth/token). The other steps are the same as for an app made under **Connections > Developers**; see [OAuth apps](/public-api/oauth). ## OpenAPI ````yaml POST /oauth/register openapi: 3.1.0 info: title: PostQueen Public API version: 1.0.0 license: name: MIT identifier: MIT description: >- Schedule posts, upload media, read analytics and manage the channels of your PostQueen workspace. ## Authentication Send your API key in the `Authorization` header exactly as it is, with no prefix: ``` Authorization: YOUR_API_KEY ``` The key is under **Connections > API Keys** in the app. Only a workspace Admin or Super Admin can reveal or rotate it. An app your users sign in to with OAuth sends its `pos_` access token in the same header, also with no prefix. The workspace needs a subscription, and the free trial counts. ## Rate limits A workspace can send 30 `POST /posts` requests an hour, and a request refused with `400` counts too. `POST /upload` and `POST /upload-from-url` allow 300 requests an hour each, per workspace. Nothing else is limited. A limited endpoint answers with `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset` headers, and over the limit with `429` and `Retry-After` (seconds). ## Terminology The app says channel, the API says integration. They are the same thing: a connected account on a network. servers: - url: https://api.postqueen.ai/public/v1 description: PostQueen security: - ApiKeyAuth: [] tags: - name: Channels description: Connected channels. The API calls them integrations. - name: Posts description: Create, list, change and delete posts - name: Media description: Upload files to the media library - name: Clipping description: >- Turn a YouTube video into short vertical clips. Not available on PostQueen yet - name: AI video description: Generate a video with AI into the media library - name: Analytics description: Channel and post metrics - name: Notifications description: The workspace's notifications - name: OAuth description: Sign-in for apps that act for other PostQueen workspaces paths: /oauth/register: post: tags: - OAuth summary: Register a client description: >- Dynamic Client Registration (RFC 7591). A client, usually an MCP client, registers itself and gets a `pcd_` client id without anyone making an app under Connections > Developers. Callbacks must be https, an http loopback address (`localhost`, `127.0.0.1`, `[::1]`) or a private-use scheme such as `cursor://`. Only the `authorization_code` grant is supported. Send `token_endpoint_auth_method: none` for a public client, which then gets no secret and must use PKCE (`S256`). A registered client that nobody has approved after 30 days may be removed. Outside `/public/v1`; takes no API key. operationId: oauthRegister requestBody: required: true content: application/json: schema: type: object required: - redirect_uris properties: redirect_uris: type: array minItems: 1 items: type: string description: The callback URLs the client may use client_name: type: string description: >- The name shown on the consent screen, up to 100 characters. Default `MCP Client` client_uri: type: string description: Accepted and not stored logo_uri: type: string description: Accepted and not stored token_endpoint_auth_method: type: string enum: - none - client_secret_post - client_secret_basic description: >- `none` for a public client with PKCE. Anything else gets a secret; the default is `client_secret_post` grant_types: type: array items: type: string description: Must include `authorization_code` when sent response_types: type: array items: type: string description: Accepted; the answer is always `code` scope: type: string description: Accepted; the scope is set by PostQueen example: client_name: My MCP client redirect_uris: - http://127.0.0.1:33418/callback token_endpoint_auth_method: none responses: '201': description: >- Registered. `client_secret` is present only for a confidential client, and is shown once content: application/json: schema: type: object properties: client_id: type: string client_secret: type: string client_secret_expires_at: type: integer description: '`0`: the secret does not expire' client_id_issued_at: type: integer description: Unix time in seconds client_name: type: string redirect_uris: type: array items: type: string token_endpoint_auth_method: type: string grant_types: type: array items: type: string response_types: type: array items: type: string scope: type: string example: client_id: pcd_5sT8wQ2eR7yU1iO4pA9sD3fG6hJ0kL2z client_id_issued_at: 1790845200 client_name: My MCP client redirect_uris: - http://127.0.0.1:33418/callback token_endpoint_auth_method: none grant_types: - authorization_code response_types: - code scope: mcp:read mcp:write '400': description: >- `invalid_redirect_uri`, `invalid_client_metadata`, or a failed body validation content: application/json: schema: type: object properties: error: type: string error_description: type: string example: error: invalid_redirect_uri error_description: >- redirect_uris must use https or a private-use scheme (http is allowed for loopback only) security: [] servers: - url: https://api.postqueen.ai description: PostQueen components: securitySchemes: ApiKeyAuth: type: apiKey in: header name: Authorization description: >- Your API key from Connections > API Keys, or an OAuth access token (`pos_...`). Send it as it is, with no `Bearer` prefix. ````