Support personal API key authentication for Max AI conversations API

Feature request

Is your feature request related to a problem?

Yes. The Max AI conversations API endpoints currently don't support personal API key authentication, which prevents automation of session analysis workflows.

When attempting to use a personal API key with the conversations endpoints:

GET /api/environments/:project_id/conversations/:conversation/ 

The API returns:

{  
  "type": "authentication_error",  
  "code": "permission_denied",  
  "detail": "This action does not support Personal API Key access",  
  "attr": null  
} 

This limitation makes it impossible to programmatically interact with Max AI for automated reporting and analysis.

Please describe.

Describe the solution you'd like

Enable personal API key authentication (with Bearer token) for all Max AI conversations API endpoints, similar to how other PostHog APIs work:

Affected endpoints:

• GET /api/environments/:project_id/conversations/
• POST /api/environments/:project_id/conversations/
• GET /api/environments/:project_id/conversations/:conversation/
• POST /api/environments/:project_id/conversations/:conversation/append_message/

Authentication should work with:

headers = {  
    "Authorization": f"Bearer {POSTHOG_PERSONAL_API_KEY}"  
} 

With appropriate scopes:

• conversation:read - for reading conversations and messages
• conversation:write - for creating conversations and sending messages

Use case
I want to build an automated daily workflow that:

1. Fetches session IDs from the previous day using the session recordings API
2. Sends those IDs to Max AI via the conversations API to request analysis
3. Retrieves the AI-generated report from the conversation
4. Delivers the report automatically via email/Slack

This would enable:

• Automated daily session analysis reports
• Programmatic integration with Max AI capabilities
• Reduced manual work for product and support teams
• Integration with external systems (support tickets, monitoring, etc.)

Business value

• For product teams: Automated daily insights without manual session review
• For support teams: Programmatic session analysis for customer issues
• For developers: Ability to integrate Max AI into custom workflows and tools
• For PostHog: Makes Max AI more valuable and increases API adoption

Describe alternatives you've considered

Current workaround
None available. The only way to use Max AI is manually through the browser UI, which defeats the purpose of automation.

Additional context

This feature would align with PostHog's existing API authentication patterns and make Max AI capabilities accessible for programmatic use, similar to insights, dashboards, and other PostHog features.

Start by tracing the handlers for the four listed Max AI conversations API endpoints and compare them with PostHog APIs that already support Personal API Key authentication. Verify the existing scope and permission checks, then confirm that Bearer tokens with conversation:read or conversation:write work for the corresponding operations and that the endpoint coverage is tested.