Back to Multi-Tenant
Enterprise Architecture

API Key Isolation

Every PostFrame API key belongs to one workspace and carries explicit scopes — send, read or admin. Keys are shown once, can be rolled or expired, and every query runs under Postgres row-level security keyed by the workspace the key resolved to.

Start freeMulti-tenant overview

Security Architecture

Tenant-scoped API keys
Every API key is bound to a single tenant_id — it can only access that tenant's data
Row-level security
Postgres RLS is forced on every PostFrame table; the workspace comes from the authenticated key, never from the request body
Roll, expire, disable
Roll a key for a new secret, set an expiry date, or disable it — the old secret stops working immediately
Usage visibility
Each key records when it was last used; failed authentications are logged with the key prefix only
Security Layers
API key bound to tenant_id
Single-tenant key binding at authentication layer
Row-level security on every query
tenant_id WHERE clause enforced at database layer
Test-mode keys
A pf_test_ key marks its sends as test mode, so they never trigger your webhooks
Scoped keys
send, read or admin — a send-only key cannot read logs or change settings

Keep exploring PostFrame

Dedicated analytics

Reports computed from your workspace's events alone.

Open Dedicated analytics

Isolated providers

Credentials, priority and limits per workspace.

Open Isolated providers

Webhook events

Signed events for delivery, opens, clicks, bounces and more.

Open Webhook events

Questions

Common questions, straight answers.

What scopes can an API key have?

send, read and admin, in any combination. A key limited to send can post emails but cannot list logs, read analytics or change settings.

Can I see the full key again later?

No. The full key is shown once at creation; PostFrame stores a hash and a 20-character prefix for lookup. If you lose it, roll the key to get a new secret.

What do I do if a key leaks?

Disable it or roll it from the API keys page. Both take effect immediately; rolling keeps the key's name and scopes and issues a new secret.

How is the workspace enforced on the database?

Every PostFrame table has Postgres row-level security forced on, and the workspace ID is set from the authenticated key inside the transaction — a query for another workspace's rows returns nothing.

Run your business from one place.

Five plans, seventeen launch apps, one dashboard. Set up in under 5 minutes — change tiers any time.

Start free$0 forever • No card • Upgrade any timeTalk to Sales

From $0 · Basic $9.95/mo · Save 20% on annual billing · Upgrade or downgrade any time