Automate Zapfeed with an organization API key.

Overview

The integrations surface lives under https://zapfeed.io/api/integrations for REST and https://zapfeed.io/api/mcp for MCP. Every request authenticates with a single bearer token - no OAuth dance, no per-host config. The org (and optionally a single board) is derived from the key, so a key can never touch another org’s data. Posts and comments created through the API are tagged source=API so your team can tell integrations apart from real users in the dashboard.

Get an API key

1. 1Open Dashboard → Settings → API keys (/admin/api-keys). API & MCP access is available on the Base plan and up.
2. 2Click New key, give it a name (e.g. ci-bug-reporter), optionally pin it to one board, and set a rate limit (default 300/hour).
3. 3Copy the plaintext key - it looks like zf_… and is shown once. Only a hash is stored; if you lose it, revoke and mint a new one.
4. 4Store it as a secret (env var, secret manager). Never commit it or expose it in client-side code.

Authentication

Send the key as a bearer token on every request:

Authorization: Bearer zf_live_xxxxxxxxxxxxxxxxxxxxxxxx

A missing or malformed header returns 401. An invalid or revoked key also returns 401. If the org’s plan no longer includes API access, requests return 403 with code: "UPGRADE_REQUIRED".

Rate limits

Each key has its own hourly budget (default 300 req/hour, configurable when you mint it). When you exceed it, requests return 429 with these headers:

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 2026-07-16T12:00:00.000Z
Retry-After: 1800

Back off until Retry-After seconds have passed. Sustained abuse blocks the key for an hour.

REST endpoints

All paths are relative to https://zapfeed.io. All bodies are JSON.

curl https://zapfeed.io/api/integrations/boards \
  -H "Authorization: Bearer zf_live_xxxxxxxxxxxxxxxxxxxxxxxx"

# → { "boards": [ { "id", "name", "slug", "description",
#                   "color", "icon", "visibility",
#                   "_count": { "posts": 42 } } ] }

curl "https://zapfeed.io/api/integrations/posts?type=BUG&status=NEW,UNDER_REVIEW&sort=most-voted&limit=25" \
  -H "Authorization: Bearer zf_live_xxxxxxxxxxxxxxxxxxxxxxxx"

# → { "posts": [ ... ], "nextCursor": "clx..." | null }
# Follow pages with ?cursor=<nextCursor>

curl -X POST https://zapfeed.io/api/integrations/posts \
  -H "Authorization: Bearer zf_live_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Checkout fails on Safari 17",
    "description": "Stack trace + repro steps...",
    "type": "BUG",
    "anonymousEmail": "reporter@acme.com",
    "browserInfo": { "ua": "Safari/17" }
  }'

# → 201 Created - the full post object

curl https://zapfeed.io/api/integrations/posts/clx123 \
  -H "Authorization: Bearer zf_live_xxxxxxxxxxxxxxxxxxxxxxxx"

curl -X PATCH https://zapfeed.io/api/integrations/posts/clx123 \
  -H "Authorization: Bearer zf_live_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{ "status": "PLANNED" }'

curl https://zapfeed.io/api/integrations/posts/clx123/comments \
  -H "Authorization: Bearer zf_live_xxxxxxxxxxxxxxxxxxxxxxxx"

curl -X POST https://zapfeed.io/api/integrations/posts/clx123/comments \
  -H "Authorization: Bearer zf_live_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{ "content": "On the roadmap for Q3 - thanks!" }'

MCP - for AI agents

The same key powers a Model Context Protocol server over Streamable HTTP at https://zapfeed.io/api/mcp. Point any MCP-capable client (Claude, editors, your own agents) at it and the tools below appear automatically - auth, scoping and rate limits are shared with the REST surface.

{
  "mcpServers": {
    "zapfeed": {
      "type": "http",
      "url": "https://zapfeed.io/api/mcp",
      "headers": { "Authorization": "Bearer zf_live_xxxxxxxxxxxxxxxxxxxxxxxx" }
    }
  }
}

list_posts returns open posts (NEW, UNDER_REVIEW, PLANNED, IN_PROGRESS) by default - pass status explicitly to see completed or closed items.

Enum reference

Field limits: title 1–300 chars, description 1–20,000 chars, comment content 1–10,000 chars. screenshotUrl must be an https:// URL.

Errors

Error bodies are JSON: { "error": "..." } (with an optional code).