Loading
A social media API lets your own software publish posts, answer comments and DMs and pull leads without anybody opening a dashboard. Bolt Claw's REST API at api.boltclaw.ai/v1 does most of what the dashboard does, with keys you issue and scope yourself. It opens with the launch.
POST /v1/posts
Authorization: Bearer bc_live_...
Idempotency-Key: 5b8f6e2c-...
{
"account_ids": ["..."],
"body": "Doors open at 9.",
"scheduled_for": "2026-11-06T09:00:00Z"
}{
"event": "social.post.published",
"post_id": "5e0c2b7a-...",
"occurred_at": "2026-11-06T09:00:04Z"
}Signed with HMAC-SHA256. Ids only, never the post itself.
Three things to set up, then the reference covers every call.
Create a key under Settings, Developers, choose its scopes and, if you like, an expiry. It is shown once; Bolt Claw keeps only its SHA-256 hash.
Send JSON over HTTPS to api.boltclaw.ai/v1 with the key as a bearer token. The version is in the path, so /v1 does not change shape under you.
Register an endpoint, pick the events you want, and check each delivery's HMAC-SHA256 signature. A failed delivery is retried with backoff for about twelve hours.
Send an Idempotency-Key with a POST, and a retried request gets the first answer back instead of doing the work twice.
The parts of an API that decide whether an integration still works a year from now.
19 scopes, from pages:read to workspace:read. A key never does more than the person who made it can do today; if they lose a permission, their keys lose it on the next request.
Give a key an expiry, rotate it with a grace period for the old one, or revoke it at once. A rotated key gets a new id.
Events for page messages, comments and DMs, posts, leads and referral programs carry identifiers only, so a misdirected endpoint never sees what anybody wrote.
Lists answer with a next_cursor to pass back, so a page never skips or repeats a row while new ones arrive.
Every error has a stable code and a request id. Branch on the code; the sentence is for people.
Your plan’s requests a minute come back on every response as X-RateLimit headers. The same calls power the MCP server for AI assistants.
Each one has its own page in the reference, with every operation, its scope and a worked request.
Your key and its workspace.
The workspace's API keys, and what each may do.
Link-in-bio pages, served at boltclaw.ai/{slug}.
The links on a page, in display order.
Threads people start from a page, and the messages in them.
The endpoints registered to receive events. Read only here.
Connected network accounts. Connecting one happens in the dashboard.
Posts to one or more connected accounts, now, scheduled, or as drafts.
Images and videos for posts, uploaded in two steps.
Comments, mentions and direct messages from every connected account.
Comment-to-DM rules that reply to people and capture leads.
Contact details people chose to give.
The organisation's plan, allowances and platform charges.
Referral programs, partners, conversions, commissions and payouts.
Device sign-in, approvals, and a key acting on itself.
What assistants did here, and what everybody did here.
The API, webhooks and the MCP server are on Free. Plans change how many requests a minute and how many keys.
Compare the plans$0, for good
$19 a month
$49 a month
$149 a month
Yes. Free includes 5 API keys and 20 requests a minute, with webhooks and the MCP server. Creator, Pro and Business raise the rate to 60, 120 and 600 requests a minute.
The same networks as the dashboard: Instagram, Facebook, Threads, Bluesky, X, TikTok, LinkedIn, YouTube and Pinterest. X needs a paid plan and is billed per call on top of it.
No. Connecting an account happens in the dashboard, where the network asks you to sign in and approve Bolt Claw. Once it is connected, the API can post to it and read its inbox.
Identifiers only: the event, when it happened, and the ids to fetch. A comment's words, a DM or a lead's email address never go into a webhook body; read them with a key that has the right scope.
Give it only the scopes it needs and, if you like, an expiry. A key also never carries more than the person who created it can do today, and removing somebody from your team revokes their keys at once.
Not yet. The API is plain JSON over HTTPS with one bearer token, the reference shows a worked request for each call, and the OpenAPI description is published for code generators. There is also a command-line tool.
The API opens with the launch. Join the waitlist and we will email you the day you can issue your first key.