Authentication

Personal access tokens, workspace header, and scopes.

Create a token in the app under Settings → CLI. It is shown once. Format: dun_pat_….

export DUN_TOKEN=dun_pat_…
export DUN_WORKSPACE_ID=your_workspace_id

The client sends Authorization: Bearer <token> and User-Agent: dunsocial-sdk/<version>. Workspace-scoped calls also send X-Workspace-Id. workspaces.list does not need a workspace id.

Scopes

Scope	SDK methods
`workspace:read`	`workspaces.`, `accounts.`, `personalization.get`
`workspace:write`	`personalization.set`, `personalization.clear`
`posts:read`	`posts.list`, `posts.get`, `posts.validate`, `drafts.list`, `drafts.get`
`posts:schedule`	`posts.schedule`, `reschedule`, `cancel`, threads
`posts:publish`	`posts.publish`, `posts.publishThread`
`posts:delete`	`posts.delete`
`drafts:write`	`drafts.create`, `update`, `delete`
`media:read` / `media:write`	Gallery vs `media.upload`
`memory:read`	Collection GET and memory list
`memory:write`	`memory.search`, save, collection writes

Missing token or workspace throws DunSocialError with code: missing_config before any request. 401 is an invalid PAT. 403 is the wrong workspace, a missing scope, or a suspended member. 402 is an unpaid workspace — see error.billingUrl.

PATs cannot call AI, billing, team admin, webhook endpoint CRUD, or CLI token admin. Those stay session-only.