Presscart API Documentation

How to authenticate with the Presscart API using bearer tokens, including token types and scopes.

The Presscart API lets you programmatically browse the media outlet marketplace, place orders for media placements, and manage PR campaigns — all through server-to-server API token authentication.

Base URL

https://api.presscart.com

Bearer header

Include your token in the Authorization header of every request:

Authorization: Bearer pc_xxxx_xxxxxxx_xxxxxxxx_xxxxxxxx

Token format

Tokens are prefixed with pc_
The raw token is only shown when the token is created or regenerated
Tokens are stored hashed on the server side

Create an API token

API tokens are created in the Presscart app by a signed-in user. There is no public API endpoint for creating one with another API token.

Prerequisites

A Presscart account that belongs to the team you want the token for. Any member of the team can create, regenerate, and revoke the team's tokens. The code applies no plan or role restriction beyond team membership.
The token belongs to the team of the workspace you are in. Switch workspace first if you belong to more than one team.

Steps

Sign in to the Presscart app and pick the workspace (team) the token is for.
Open Tools in the sidebar and select API Keys. You can also open your account menu (your name at the bottom of the sidebar) and select API Keys.
Click New API key.
Enter a Name, such as Production or Staging, and click Generate key.
Copy the key from the API Key Created dialog before you click Done. The raw key is shown only once and cannot be viewed again.

The page is called API Keys in the app; this documentation calls the same credential an API token.

Good to know

Tokens created in the app are always full_access and never expire. The app does not let you choose a token type, scopes, or an expiry, so custom and read_only tokens cannot be created there.
Use Regenerate on a key to get a new value. The old value stops working immediately.
Use Revoke to disable a key permanently. Revoking cannot be undone.
The API Keys page also lists the endpoints available to your team.
Keys are managed with a signed-in app session. Calls to the key-management endpoints (/teams/{team_id}/api-keys) with a pc_ token are rejected, so an integration cannot mint its own tokens.

Token types

Type	Description
`full_access`	Bypasses scope checks for all API-token routes
`custom`	Can only access the explicit scopes attached to the token
`read_only`	Can read and list resources for its scopes but cannot perform write actions

Scopes

Scopes control which endpoints your token can access. Assign only the scopes your integration needs.

Scope	Routes
`outlets.lists`	`GET /outlets`
`outlets.read`	`GET /outlets/\{outlet_id\}`
`products.read`	`GET /products/\{product_id\}`, `GET /products/listings`
`orders.lists`	`GET /orders`, `GET /order-items`, `GET /profiles/\{profile_id\}/orders`, `GET /profiles/\{profile_id\}/order-items`
`orders.read`	`GET /orders/\{order_id\}`
`orders.create`	`POST /orders/checkout`
`teams.read`	`GET /teams/\{team_id\}`
`teams.update`	`PUT /teams/\{team_id\}`
`profiles.create`	`POST /profiles`
`profiles.update`	`PATCH /profiles/\{profile_id\}`
`profiles.lists`	`GET /teams/\{team_id\}/profiles`
`campaigns.lists`	`GET /campaigns`, `GET /profiles/\{profile_id\}/campaigns`
`campaigns.read`	`GET /campaigns/\{campaign_id\}`, `GET /campaigns/\{campaign_id\}/articles`, `GET /campaigns/\{campaign_id\}/articles/status-count`
`campaigns.create`	`POST /campaigns`
`campaigns.update`	`PUT /campaigns/\{campaign_id\}`, `POST /campaigns/\{campaign_id\}/order-items`, `POST /questionnaires/\{campaign_id\}/link`

Verify your token

Confirm your token is valid and inspect your session:

curl "https://api.presscart.com/auth/token" \
  -H "Authorization: Bearer $PRESSCART_API_TOKEN"

Response:

{
  "source": "api_token",
  "team_id": "11111111-1111-1111-1111-111111111111",
  "token_type": "custom",
  "scopes": ["products.read", "orders.create", "campaigns.update"],
  "pro_pricing_enabled": true
}

Authentication