Community Edition vs Staqly Cloud

Staqly comes in two forms:

• Staqly Cloud is the hosted service at app.staqly.ai. You sign up, invite your team, give each agent its own scoped API key, and pay per user for a plan. We run the servers, the backups and the updates.
• Staqly Community Edition is the self-hosted option: the open-source app (AGPL-3.0) on your own computer or server, as one binary (staqly serve) or one Docker container. One workspace, one access token, no plan limits, and you take care of backups and updates yourself.

Both run the same app with the same REST API, MCP tools, SDKs and dashboard. Self-hosting is supported for the Community Edition only.

If you want to try Staqly on your own machine first, start with the Community Edition quickstart.

Staqly CloudCopy Anchor Link

Create an account with Google or your email address. Your first sign-in creates an account with a workspace, and the welcome walks you through naming it, choosing a plan and connecting a first channel.

• Members and roles: owners and admins invite people as owner, admin, editor or viewer under Settings → Members. A role is read on every request. See Accounts, members and roles.
• API keys (stk_...) are for agents and scripts, scoped, and never more than their creator's current role; only their SHA-256 hashes are stored. Manage them under Integrations → API keys. See Authentication & scopes.
• The dashboard uses an HttpOnly session cookie and a CSRF token after sign-in. Connect a device signs a phone in as the same person with a QR code.
• Plans limit each workspace; over a limit the API answers 402 plan_limit_exceeded. The account owner chooses Starter, Plus, Pro or Business by card under Settings → Plan & usage and manages the subscription in the Stripe portal. See Plans, Plan & usage and Limits.

Connecting clients to Staqly CloudCopy Anchor Link

Clients use the hosted address plus your workspace's API key:

curl "https://app.staqly.ai/v1/posts?status=scheduled" \
  -H "Authorization: Bearer $STAQLY_API_KEY"

Several workspaces means several keys: each key only sees its own workspace.

Community EditionCopy Anchor Link

Start staqly with staqly serve (or the Docker image) and you are ready: no sign-up, no account, no password. On first start staqly makes an access token, and at every start it prints it with a link that opens the dashboard signed in:

Staqly Community Edition (local mode): every request needs the access token.
  Open the dashboard:  http://localhost:8080/#token=stk_local_...
  Access token:        stk_local_...

The token is the one key of a Community Edition install. Agents, n8n, scripts, the SDKs and curl send it as Authorization: Bearer {ACCESS_TOKEN}; the token holder has full access to the one workspace.

STAQLY_MODE=local is the default and the only mode the self-hosting docs cover; you don't need to set it.

The access tokenCopy Anchor Link

• It lives in the data folder as access_token, readable only by you (mode 0600). With staqly serve that is ~/.local/share/staqly/access_token; with Docker, the staqly-data volume.
• Print it again with staqly serve token (binary) or docker exec staqly server token (Docker). Agents, CLI and SDK setups can read it straight from that command: export STAQLY_API_KEY=$(staqly serve token).
• The staqly CLI on the same computer as staqly serve needs nothing: it reads the token from the data folder by itself.
• Make a new one with staqly serve token --rotate (or docker exec staqly server token --rotate), or Rotate next to the access token under Integrations in the dashboard. The old token stops working at once, also in a running server, and every browser is signed out (the dashboard you rotate from stays signed in). Update your agents' configuration with the new token.
• docker exec -i staqly mcp-stdio needs no token: it opens the database itself, so whoever may run it already has the data.

Signing a browser inCopy Anchor Link

• Open the link staqly printed at start (http://localhost:8080/#token=...). The token travels in the part of the address after #, which browsers never send to a server, and the dashboard removes it from the address bar once it has signed in.
• Or open the dashboard and paste the access token on its sign-in page.
• Phones and tablets scan a QR code from Connect a device in a signed-in dashboard, or open a one-time link from staqly serve connect-link (binary) or docker exec staqly server connect-link (Docker). See Phones & tablets.

Why the Community Edition is safeCopy Anchor Link

• Every request carries a credential: the access token, or a browser session made with it. A website you visit, a page on another localhost port or a DNS-rebinding page can't attach either, so none of them can drive your staqly, and other programs on your computer can't either unless they can read your files.
• The API binds to 127.0.0.1, so nothing outside this computer can reach it directly (defense in depth). Run outside Docker (staqly serve), the server itself listens on 127.0.0.1:3333; with Docker, docker run -p 127.0.0.1:3333:3333 publishes the port on 127.0.0.1 only.
• Browser sessions use an HttpOnly, SameSite=Lax cookie, and every change needs the session's CSRF token.
• The token is stored in an owner-only file, never in the database or the logs; staqly prints it on the terminal (or docker logs) at start.

A request without the token, or with a wrong one, gets 401 unauthorized. The settings of the older keyless local mode (LOCAL_TRUSTED_PEERS, LOCAL_ALLOWED_HOSTS, LOCAL_ALLOWED_ORIGINS) are no longer read; staqly warns at start when one is still set.

Next stepsCopy Anchor Link