# Postscript setup for PopMCP

You end up with the Private Key half of a Postscript API security key pair, an sk_ string that you paste into PopMCP's API key field.

- Auth: API credentials
- Setup time: 3 min
- API base URL: https://api.postscript.io/api/v2
- Credentials screen: https://app.postscript.io/account/api
- Provider docs: https://developers.postscript.io/docs/api-authentication

## Before you begin

- A Postscript account with the shop you want to connect already selected.
- A role that can open the shop menu and reach **API**, such as shop owner or admin.
- Partners only: a Partner API key issued by Postscript to approved Integration Partners. There is no self-serve way to create one, so request it from your Postscript contact.

## Get your credentials

### 1. Open the API page for your shop

Sign in at app.postscript.io and select your Shop Name in the side menu, then select API. If you manage several shops, switch to the right one first with Select Shop.

Screen: https://app.postscript.io/account/api

### 2. Create a security key pair

Select Create Security Key Pair on the right of the page, then confirm with Yes.

### 3. Label the pair and reveal the private key

Type a label such as PopMCP in the Label column so you can track where the key is used. Select Show in the Private Key column and copy the `sk_` value.

### 4. Paste it into PopMCP

Put the private key in PopMCP's API key field and leave Shop token blank.

## Fields PopMCP asks for

- API key (apiKey) [required]: Postscript dashboard (app.postscript.io) → Account → API → copy your PRIVATE API key (not the Public key). If none is shown, click Create Security Key Pair first. Stored encrypted; used server-side only (sent as Authorization: Bearer). The connection is locked to this key's shop.
- Shop token (partners only, optional) (shopToken): Only for Postscript technical partners: put your PARTNER key in the API key field above and the target shop's Private API Key here. It is sent as X-Postscript-Shop-Token. Shops connecting their own account should leave this blank.

## Verify

The Postscript connector in PopMCP shows Connected and a read call such as listing subscribers returns rows from the shop whose key you pasted.

## Troubleshooting

### 401 Unauthorized on every call

Cause: The Public Key was pasted instead of the Private Key, or the pair was disabled or deleted.

Fix: Open the shop menu, select API, check the row shows Enabled, and use Show in the Private Key column to copy the correct value.

### Calls return data for the wrong store

Cause: A different shop was active when the key pair was created. Keys are bound to one shop.

Fix: Use Select Shop to switch to the right shop, create a key pair there, and reconnect PopMCP with it.

### 429 with "Rate limit exceeded"

Cause: More than 15 requests per second on that token.

Fix: Space the calls out and retry. The limit is per token, so a partner key paired with a shop token shares one bucket.

### Partner key returns 403 for a shop

Cause: The shop token header is missing or holds the shop's public key.

Fix: Put the partner key in API key and the shop's private key in Shop token.

---

Source: https://www.docs.popmcp.com/docs/integrations/postscript/