Authentication

PostHealth uses personal bearer keys for developer access. Create and revoke keys from an authenticated PostHealth session; the secret is shown only once.

Send a request

GET /api/v1/summary?days=30
Host: api.posthealth.dev
Authorization: Bearer fbt_live_...

Keep the key in an environment variable such as POSTHEALTH_API_KEY. Never commit it to a repository or embed it in a browser bundle.

curl "https://api.posthealth.dev/api/v1/summary?days=30" \\
  -H "Authorization: Bearer $POSTHEALTH_API_KEY"

Abilities

New keys default to read access. Workout-log writes require a key explicitly created with the workout:write ability.

POST /api/keys
Content-Type: application/json

{"name":"personal assistant","abilities":["read"]}

Rate limits and privacy

• Each key is limited to 120 requests per wall-clock minute.
• Every bearer key belongs to exactly one signed-in Google Health account.
• Missing source values remain null; PostHealth does not invent measurements.
• Public shares are scoped, expiring, raw-free, and revocable.

For account deletion and Google consent details, see the PostHealth privacy page.