Connect a social account
Create a short-lived authorization URL and complete a provider OAuth connection safely.
Configure a provider app, request POST /v1/social-accounts/auth-url, and redirect the user to the returned auth_url before it expires. After the provider callback succeeds, list accounts and fetch the connected account's capability matrix before exposing publishing controls.
What this means in practice
Configure a provider app, request POST /v1/social-accounts/auth-url, and redirect the user to the returned auth_url before it expires. After the provider callback succeeds, list accounts and fetch the connected account's capability matrix before exposing publishing controls.
Use the documented brand and account boundaries consistently across the scheduler, REST API, SDK, MCP tools, SSE consumers, and webhooks. That makes the same social operation explainable to an operator and reproducible by an integration.
Implementation checklist
Configure either an App9-managed credential option or an approved customer-provided provider app.
Request an authorization URL for the provider and an allowlisted post-connection destination.
Redirect in the same browser context and preserve your own application state separately.
Handle cancellation, denied scopes, expired state, and provider review restrictions explicitly.
Refresh the social-account list and capabilities after the callback completes.
Example request
This example uses a server-side API key and an explicit brand selection. Replace placeholder values and keep credentials out of browser bundles, client logs, and source control.
curl --request POST \
--url 'https://postapi.app9.co/v1/social-accounts/auth-url' \
--header 'Authorization: Bearer APP9_POST_API_KEY' \
--header 'X-App9-Post-Brand: BRAND_ID' \
--header 'Content-Type: application/json' \
--data '{
"provider": "instagram",
"redirect_after": "https://app.example.com/settings/social"
}'Operational details
Authorization URLs are short-lived and should not be cached or emailed as permanent links.
The connected account resource does not expose provider access or refresh tokens.
Providers may return more than one selectable page, channel, profile, or board context.
Common mistakes to avoid
- Do not construct provider authorization URLs yourself from stored secrets.
- Do not assume a successful login grants every permission requested by your product.
- Do not show publish controls before checking the account's current capabilities.