Outstand API Documentation

Learn how to obtain and use an Outstand API key to authenticate your requests to the unified social media API.

A valid API key is required to use the Outstand API. In this section, you can find information on how to obtain an API key as well as how to use it.

Authentication Methods

We currently support only one authentication method: API key.

Obtaining an API Key

To obtain an API key, you can go to the Outstand website and click on the "Get API Key" button.

The generated API key is unique for your user account, even if more members belong to your organization.

Be ready to copy the API key to a secure location, as you won't be able to see it again after generating it.

Using an API Key

To use an API key, you can pass it in the Authorization header of your requests.

Authorization: Bearer <api_key>

Example Request

A successful authenticated request looks like this:

curl -X GET https://api.outstand.so/v1/social-accounts \
  -H "Authorization: Bearer sk_live_abc123def456"

Response:

{
  "success": true,
  "data": [
    {
      "id": "acc_123",
      "network": "x",
      "username": "@mycompany"
    }
  ]
}

If the API key is missing or invalid, you will receive an error response:

{
  "success": false,
  "error": "Invalid or missing API key"
}

Authenticating successfully is not enough on its own: the organization that owns the API key must also have an active subscription. If it does not, every API endpoint responds with 402 Payment Required:

{
  "success": false,
  "error": "Your organization does not have an active subscription.",
  "code": "subscription_inactive",
  "billingUrl": "https://www.outstand.so/app/settings/billing"
}

Only the active subscription status grants API access. Any other status - including trialing, past_due, unpaid, incomplete and canceled - results in a 402.

Treat a 402 as non-retryable: retrying the request will keep failing until the subscription is reactivated in billing settings. Once it is active again, access is restored automatically with no further action needed.

Rate Limits

We use dynamic rate limits based on your post traffic and the number of accounts you have connected, so there is no single published number to code against - your limit scales with how you actually use the API.

Because of that, read your current limit from the response headers rather than hardcoding it. Every successful request on a rate limited key describes the window it belongs to:

Header	Meaning
`X-RateLimit-Limit`	Maximum requests allowed within the current window
`X-RateLimit-Remaining`	Requests still available in the current window
`X-RateLimit-Reset`	Unix timestamp (seconds) at which the window resets

Pace your requests off X-RateLimit-Remaining and you should never hit the limit. If you do, the request is rejected with 429 Too Many Requests:

{
  "error": "API key rate limit exceeded",
  "details": "Rate limit exceeded."
}

A 429 is retryable. Unlike a 401, it does not mean your key is wrong - there is no need to rotate it. When the response carries a Retry-After header, wait that many seconds before trying again; otherwise back off exponentially.

Some keys carry a fixed request quota instead of a rolling window. When that quota runs out the response is also a 429, but with "error": "API key request quota exhausted". Waiting will not help in that case - get in touch to have the quota raised or refilled.

Multiple API Keys

You can issue multiple API keys for your organization, each with a different name. It's a good practice to create a new API key for each project or application you are working on - as well as use separate API keys for development and production environments.

Authentication