> ## Documentation Index > Fetch the complete documentation index at: https://docs.hookmyapp.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a media container (API key) > Create an Instagram media container with your `hmok_` API key. Poll `GET /channels/{ch}/instagram/containers/{containerId}` until `status` is `finished`, then publish it. Delivery is at-least-once: do not retry a request whose response you did not receive without checking the container's status first. Use `Authorization: Bearer hmok_...` (an API key, or a dashboard session) instead of a channel token. Accepted scope is `channel.manage`. Delivery is at-least-once: don't automatically retry after an ambiguous failure (timeout, dropped connection). Check the container's status first to see whether it was already created. Create the container, poll its status until `finished`, then publish. Videos and reels can take minutes; a publish on a container that is still processing answers 409 and can be retried. If you need the raw Graph request, see the [`hmat_` gateway twin](/instagram/api/publishing/create-media-container). ## OpenAPI ````yaml api-reference/openapi.yaml POST /channels/{ch}/instagram/containers openapi: 3.1.0 info: title: HookMyApp API version: 1.0.0 description: > The HookMyApp REST API. Everything the dashboard and the CLI can do, your code and your AI agents can do too. ## Authentication Two kinds of Bearer credentials exist. Do not mix them up: - **API key (`hmok_...`)** authenticates *you* (or your agent) to `https://api.hookmyapp.com`. Create one in the dashboard under **Org → API keys → Create API Key** (full org access, optional expiration date, reveal or revoke it any time from that page), or without a browser via the [agent auth flow](#tag/agent-auth) described in [`GET /auth.md`](https://api.hookmyapp.com/auth.md). That flow can mint a scope-limited key. Send it as `Authorization: Bearer hmok_...`, or on `/mcp` as `X-API-Key: hmok_...`. Use it for org, workspace, customer, channel and webhook management. - **Channel token (`hmat_...`)** sends messages, replies to comments, and publishes from one connected channel. Mint it with `GET /meta/channels/{id}/token`. It is not valid on `https://api.hookmyapp.com`. The same sends, replies and publishing are also available with the API key under `/channels/{ch}` (see the Channel actions tag). Browser sessions from the dashboard use the same endpoints with a session cookie or WorkOS JWT instead of `hmok_`. ## IDs Every ID on the wire is a typed public ID, never an internal UUID: `ws_` workspace/customer, `ch_` channel, `org_` organization, `cred_` connection credential, `ac_` agent credential. ## Workspace context Workspace-scoped routes (channels, webhook config, and deliveries) resolve the workspace from the `X-Workspace-Id: ws_XXXXXXXX` header. ## Errors Errors return a stable machine-readable `code` plus a human `message`. Agent tokens that exceed their granted scopes get `403 AGENT_SCOPE_INSUFFICIENT`. ## Webhook signatures Deliveries to your webhook are signed with `X-HookMyApp-Signature-256`, an HMAC-SHA256 of the raw body keyed on the channel `WEBHOOK_HMAC_SECRET`. The Verify Token is a separate value used only for the GET ownership probe. servers: - url: https://api.hookmyapp.com description: Production security: - bearerAuth: [] tags: - name: Agent auth description: Register an agent credential (`hmok_`) with email OTP, no browser needed - name: Organizations description: Your organization and its summary - name: Customers description: Customer workspaces you run messaging for (SaaS Mode) - name: Onboarding links description: Links your customers open to connect their own channels - name: Workspaces description: Team workspaces - name: Channels description: Connected WhatsApp and Instagram channels, and their channel tokens - name: Webhook config description: Where inbound events are delivered for a channel - name: Deliveries description: Inspect inbound delivery logs and app responses - name: Channel actions description: >- Send, reply, moderate and publish on a channel with the API key; the channel token stays server-side paths: /channels/{ch}/instagram/containers: post: tags: - Channel actions summary: Create a media container (API key) description: | Create an Instagram media container with your `hmok_` API key. Poll `GET /channels/{ch}/instagram/containers/{containerId}` until `status` is `finished`, then publish it. Delivery is at-least-once: do not retry a request whose response you did not receive without checking the container's status first. operationId: createInstagramContainer parameters: - name: ch in: path required: true schema: type: string description: ch_ channel id requestBody: required: true content: application/json: schema: type: object required: - mediaType properties: mediaType: type: string enum: - IMAGE - VIDEO - REELS - STORIES - CAROUSEL imageUrl: type: string videoUrl: type: string caption: type: string coverUrl: type: string altText: type: string locationId: type: string audioName: type: string shareToFeed: type: boolean thumbOffset: type: integer minimum: 0 children: type: array items: type: object properties: imageUrl: type: string videoUrl: type: string userTags: type: array items: type: object required: - username properties: username: type: string x: type: number 'y': type: number trialParams: type: object properties: graduationStrategy: type: string enum: - manual - automatic responses: '200': description: Container created content: application/json: schema: type: object required: - channelId - containerId properties: channelId: type: string containerId: type: string '400': $ref: '#/components/responses/Error' '401': $ref: '#/components/responses/Error' '403': $ref: '#/components/responses/Error' '404': $ref: '#/components/responses/Error' components: responses: Error: description: Error content: application/json: schema: $ref: '#/components/schemas/Error' schemas: Error: type: object properties: statusCode: type: integer example: 403 description: HTTP status code mirrors the response status: null code: type: string description: Stable machine-readable code, e.g. `AGENT_SCOPE_INSUFFICIENT` message: type: string requestId: type: string description: Include this when contacting support about the request securitySchemes: bearerAuth: type: http scheme: bearer description: '`Authorization: Bearer hmok_...` API key or a dashboard session token' ````