Drive post mate from any script.

curl -sS "https://post-mate.com/api/v1/posts?limit=10&status=scheduled" \
  -H "Authorization: Bearer pmk_YOUR_KEY_HERE"

curl -sS "https://post-mate.com/api/v1/posts" \
  -H "Authorization: Bearer pmk_YOUR_KEY_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "text",
    "caption": "Day 14 of #buildinpublic — we just shipped the API.",
    "social_account_ids": ["b2c5…", "f0a1…"],
    "scheduled_at": "2026-06-01T09:00:00Z"
  }'

curl -sS "https://post-mate.com/api/v1/media" \
  -H "Authorization: Bearer pmk_YOUR_KEY_HERE" \
  -F "file=@./hero.jpg"

const res = await fetch("https://post-mate.com/api/v1/posts", {
  method: "POST",
  headers: {
    "authorization": "Bearer " + process.env.POSTMATE_KEY,
    "content-type": "application/json",
  },
  body: JSON.stringify({
    type: "image",
    caption: "Shipped!",
    social_account_ids: [accountId],
    media: [{ key: mediaKey, mime_type: "image/jpeg", size_bytes: 124_800 }],
  }),
});
if (!res.ok) throw new Error(`post mate API: ${res.status}`);
const { id } = await res.json();

import os, requests

headers = {"authorization": f"Bearer {os.environ['POSTMATE_KEY']}"}

# 1) Upload media first
with open("hero.jpg", "rb") as f:
    media = requests.post(
        "https://post-mate.com/api/v1/media",
        headers=headers,
        files={"file": ("hero.jpg", f, "image/jpeg")},
    ).json()

# 2) Reference it in the post
post = requests.post(
    "https://post-mate.com/api/v1/posts",
    headers={**headers, "content-type": "application/json"},
    json={
        "type": "image",
        "caption": "Shipped!",
        "social_account_ids": [account_id],
        "media": [{
            "key": media["key"],
            "mime_type": media["mime_type"],
            "size_bytes": media["size_bytes"],
        }],
    },
).json()
print(post["id"])

{
  "event": "post.published",
  "timestamp": "2026-05-19T14:32:18.045Z",
  "data": {
    "post_id": "8b0c5e8a-…",
    "status": "posted",
    "caption": "Shipped!",
    "type": "image",
    "targets": [
      {
        "id": "…",
        "social_account_id": "…",
        "platform": "instagram",
        "account_name": "@yourhandle",
        "status": "posted",
        "platform_post_id": "C7…",
        "platform_post_url": "https://instagram.com/p/C7…",
        "error_message": null
      }
    ]
  }
}

import crypto from "node:crypto";
import express from "express";

const app = express();
// IMPORTANT: keep the raw body — JSON.parse'd objects re-serialize
// differently and break the HMAC compare.
app.post("/post-mate/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const ts = req.header("x-postmate-timestamp");
  const sig = req.header("x-postmate-signature");
  const body = req.body.toString("utf8");

  if (!ts || !sig || Math.abs(Date.now() / 1000 - Number(ts)) > 300) {
    return res.status(400).send("stale or missing timestamp");
  }
  const expected =
    "sha256=" +
    crypto
      .createHmac("sha256", process.env.POSTMATE_WEBHOOK_SECRET)
      .update(`${ts}.${body}`)
      .digest("hex");
  if (
    sig.length !== expected.length ||
    !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))
  ) {
    return res.status(401).send("bad signature");
  }

  const event = JSON.parse(body);
  console.log(event.event, event.data); // post.published / post.failed / post.scheduled
  res.json({ ok: true });
});

import os, hmac, hashlib, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["POSTMATE_WEBHOOK_SECRET"].encode()

@app.post("/post-mate/webhook")
def receive():
    ts = request.headers.get("X-Postmate-Timestamp", "")
    sig = request.headers.get("X-Postmate-Signature", "")
    body = request.get_data()  # raw bytes; do NOT use request.json
    if not ts or abs(time.time() - int(ts)) > 300:
        abort(400)
    mac = hmac.new(SECRET, f"{ts}.".encode() + body, hashlib.sha256)
    expected = "sha256=" + mac.hexdigest()
    if not hmac.compare_digest(sig, expected):
        abort(401)
    event = request.get_json()
    print(event["event"], event["data"])
    return {"ok": True}