There is no active posting key. It can be rather private posting key or private active key. And yes both have different uses.
Voting/posting use private posting key, and other things like transfer or changing account autorithy require private active key. There are also other keys like the private memo key which permit to decode memo encoded with your public memo key etc.. .

In this case, you are not willing to give any key but just give the authority for an app to post for you. The other possibilities would be:

• the app ask your posting key and store it (this is less secure then steemlogin which has been tested for nearly 4 years now)
• the app ask your posting key with steemlogin and store the received token and can reuse it. The issue with this solution is the following one, steemlogin tokens have an expiration time like all web tokens, so after a week this particular token become unusable and you would need to login again to the app to obtain a new token... Which removes all interest in using a service like steemauto.
  So in order to do that you are using your private active key to give posting authority to the app. Which means this app can post/vote for you whenever he need/want and that until you revoke the posting authority, again using your private active key.

Well I'm sorry for you but I guess you just fell in with the wrong crowd as we all already did at least once.

Hopefully other witnesses will come to confirm all what I said there.

Best regards,
hightouch