Channel credentials

PostingPilot publishes directly to each platform using credentials you create in that platform's own developer console. Nothing is routed through a third-party scheduler, so the permissions stay under your control and you can revoke them at any time.

Every credential is stored per workspace, encrypted at rest with AES-256-GCM, and is only decrypted server-side at publish time. Keys are never returned to the browser.

1. 1Create the app/token in the platform's developer console using the steps below.
2. 2In PostingPilot open Settings, choose the workspace, and paste the values into the fields for that platform.
3. 3Go to Channels, add the channel, and press Test connection - PostingPilot verifies the token and pulls the connected account name.
4. 4The channel shows Ready when it can publish. Anything missing (token, account ID, expired key) is listed on the connection health panel.

Tip: Use the redirect/callback URL https://postingpilot.app/app/channels for any OAuth app you create, unless the platform-specific steps say otherwise.

LinkedIn posts are published to your member profile (or an organisation page if your app is approved for it).

1. 1Go to the LinkedIn Developer portal and create an app, linking it to a LinkedIn Page you administer.
2. 2On the Products tab, request 'Share on LinkedIn' and 'Sign In with LinkedIn using OpenID Connect'. For company pages also request 'Community Management API'.
3. 3On the Auth tab add the redirect URL https://postingpilot.app/app/channels and copy the Client ID and Client Secret.
4. 4Authorise with the scopes openid, profile, w_member_social (add w_organization_social for pages) and copy the resulting access token.
5. 5In PostingPilot Settings paste the access token as the LinkedIn credential.
6. 6Add the LinkedIn channel and press Test connection - PostingPilot resolves your member URN automatically.

• Required values: access token (member or organisation).
• Token lifetime: 60 days for member tokens - reconnect when the token health panel flags it.
• Limits: text and link posts; images supported, video via upload.

1. 1At developers.facebook.com create an app of type Business and add the Facebook Login and Pages products.
2. 2In the Graph API Explorer select your app, then select the Page you want to publish to.
3. 3Request the permissions pages_manage_posts, pages_read_engagement and pages_show_list, then generate a user access token.
4. 4Exchange it for a long-lived Page access token (Access Token Debugger shows the expiry; a Page token derived from a long-lived user token does not expire).
5. 5Copy the Page ID from the Page's About tab or from /me/accounts.
6. 6In PostingPilot Settings paste the Meta access token, then add the Facebook channel and enter the Page ID.

• Required values: long-lived Page access token, Page ID.
• App review: publishing to Pages you do not administer requires Meta App Review; your own Pages work in development mode.
• Status reconciliation: add the PostingPilot webhook in the Meta app's Webhooks product if you want delivery confirmations pushed back.

Instagram publishing uses the same Meta app and token as Facebook. The account must be an Instagram Business or Creator account linked to a Facebook Page.

1. 1Convert the Instagram account to Business/Creator and link it to your Facebook Page (Page settings, Linked accounts).
2. 2In the Meta app add the Instagram Graph API product.
3. 3Add the permissions instagram_basic, instagram_content_publish and pages_read_engagement to the token you generated for Facebook.
4. 4Find the Instagram Business account ID via the Graph API: /{page-id}?fields=instagram_business_account.
5. 5In PostingPilot add the Instagram channel and enter the Instagram Business account ID; the Meta token from Settings is reused.

• Required values: Meta access token, Instagram Business account ID.
• Every Instagram post must include an image or video - PostingPilot blocks publishing otherwise.
• Limit: 25 API-published posts per account per 24 hours (Meta's cap).

1. 1In the Meta developer console add the Threads API product to your app (it uses a separate Threads app ID and secret).
2. 2Add the redirect URL https://postingpilot.app/app/channels.
3. 3Authorise with the scopes threads_basic and threads_content_publish.
4. 4Exchange the short-lived token for a long-lived Threads token (60 days).
5. 5Paste the Threads access token in PostingPilot Settings, then add the Threads channel and Test connection.

• Required values: Threads long-lived access token.
• Limits: 500 characters, one image or video per post, 250 posts per 24 hours.

1. 1In Google Cloud Console create a project and enable the YouTube Data API v3.
2. 2Configure the OAuth consent screen (External), add your Google account as a test user, and add the scope https://www.googleapis.com/auth/youtube.upload.
3. 3Create an OAuth client ID of type Web application with the redirect URI https://postingpilot.app/app/channels.
4. 4Authorise once with access_type=offline and prompt=consent to obtain a refresh token.
5. 5In PostingPilot Settings paste the client ID, client secret and refresh token, then add the YouTube channel.

• Required values: OAuth client ID, client secret, refresh token.
• Default quota is 10,000 units/day - each upload costs about 1,600 units (roughly six uploads a day).
• Unverified apps upload videos as private until Google verifies the project.

1. 1At developer.x.com create a project and an app on a plan that allows write access (Free tier permits limited posting).
2. 2In User authentication settings enable OAuth 2.0, set App permissions to Read and write, app type Web App, and the callback URL https://postingpilot.app/app/channels.
3. 3Copy the OAuth 2.0 Client ID and Client Secret.
4. 4Authorise with the scopes tweet.read, tweet.write, users.read and offline.access, and copy the access and refresh tokens.
5. 5Paste the client ID, client secret and refresh token in PostingPilot Settings, then add the X channel.

• Required values: OAuth 2.0 client ID, client secret, refresh token.
• Access tokens last two hours - PostingPilot refreshes them automatically using the refresh token.
• Limits: 280 characters, up to four images or one video.

1. 1At developers.tiktok.com create an app and add the Content Posting API product.
2. 2Add the scopes video.publish (or video.upload) and user.info.basic.
3. 3Set the redirect URI to https://postingpilot.app/api/public/tiktok/callback.
4. 4Copy the Client key and Client secret into PostingPilot Settings.
5. 5On the Channels page press Connect TikTok and complete the TikTok login - PostingPilot stores the tokens for you.

• Required values: client key, client secret (the OAuth flow supplies the tokens).
• Until your app passes TikTok audit, posts publish to a private/draft state for the creator to confirm.
• Refresh tokens last 365 days; re-authorise from Channels when flagged.

• Encryption: keys are encrypted with AES-256-GCM before they touch the database and are decrypted only inside the publisher.
• Rotation: replacing a key in Settings re-encrypts it immediately; the key rotation banner tells you if any legacy value still needs re-saving.
• Access: only workspace owners and editors can view or change credentials; viewers and client portal users never see them.
• Revoking: delete the value in Settings, then revoke the app's access in the platform console to be certain.

• 'Test connection' fails with 401/invalid token: the token expired or the app permissions changed - regenerate and paste it again.
• Publishing fails with a permissions error: a required scope is missing; re-authorise with the scopes listed for that platform.
• Instagram publish blocked: the post has no image, or the account is not a Business/Creator account linked to a Page.
• Rate limited: PostingPilot queues and retries automatically with backoff - watch the retry queue and delivery history.

Tip: Still stuck? Ask Pilot inside the app, or send the workspace, channel and timestamp from Delivery history to support.

Print this checklist or share the PDF with whoever administers each social account. Tick every line for a network before you schedule to it; the in-app credentials wizard (Setup, Credentials wizard) checks the same items automatically and finishes with a live connection test.

• Values marked required must be present or publishing will fail.
• Paste secrets into PostingPilot only — they are encrypted at rest and never emailed.
• After saving, press Test connection: a green result means the token, scopes and account ID all check out.

LinkedIn

• [ ] App created in the LinkedIn developer portal and linked to a Page
• [ ] Products approved: Share on LinkedIn, Sign In with OpenID Connect (plus Community Management for pages)
• [ ] Scopes on the token: openid, profile, w_member_social (w_organization_social for pages)
• [ ] Required value saved: access token
• [ ] Optional: author URN for the profile or organisation
• [ ] Test connection passes

Facebook Page

• [ ] Business app created with Facebook Login and Pages products
• [ ] Permissions granted: pages_manage_posts, pages_read_engagement, pages_show_list
• [ ] Short-lived token exchanged for a long-lived Page token
• [ ] Required values saved: Page access token, Page ID
• [ ] Test connection passes

Instagram Business

• [ ] Account converted to Business/Creator and linked to the Facebook Page
• [ ] Instagram Graph API product added to the Meta app
• [ ] Permissions granted: instagram_basic, instagram_content_publish, pages_read_engagement
• [ ] Required values saved: Meta access token, Instagram Business account ID
• [ ] Every post has an image or video attached
• [ ] Test connection passes

Threads

• [ ] Threads API product added, redirect URL registered
• [ ] Scopes granted: threads_basic, threads_content_publish
• [ ] Short-lived token exchanged for the 60-day long-lived token
• [ ] Required values saved: Threads access token, Threads user ID
• [ ] Test connection passes

YouTube

• [ ] Google Cloud project created with YouTube Data API v3 enabled
• [ ] OAuth consent screen configured with the youtube.upload scope
• [ ] Web application OAuth client created with the PostingPilot redirect URI
• [ ] Authorised with access_type=offline and prompt=consent
• [ ] Required values saved: client ID, client secret, refresh token
• [ ] Test connection passes

X (Twitter)

• [ ] Project and app created on a plan that allows write access
• [ ] OAuth 2.0 enabled, App permissions set to Read and write, callback URL registered
• [ ] Scopes granted: tweet.read, tweet.write, users.read, offline.access
• [ ] Required values saved: client ID, client secret, refresh token
• [ ] Test connection passes

TikTok

• [ ] App created with the Content Posting API product
• [ ] Scopes granted: video.publish (or video.upload), user.info.basic
• [ ] Redirect URI set to the PostingPilot TikTok callback
• [ ] Required values saved: client key, client secret
• [ ] Connect TikTok completed on the Channels page
• [ ] Test connection passes

Tip: Keep a note of who owns each developer account — token renewals need the same login.