Field notes for building on social platform APIs

pg-boss vs BullMQ compared: scheduling, retries, rate limits, transactions and throughput, now that BullMQ 6 also runs on PostgreSQL. Plus a decision checklist.

How to schedule TikTok posts in 2026: the desktop scheduler, the TikTok Studio app, the 10-day limit, why the option goes missing and what the API can't do.

BullMQ vs RabbitMQ compared on delayed jobs, cron schedules, retries and rate limits, plus what BullMQ's Postgres backend and RabbitMQ 4.4 changed in 2026.

The Hootsuite API in 2026: how to get a client ID, whether it is free, OAuth grants, rate limits, how to schedule posts and the networks it cannot post to.

How to automate Instagram posts in 2026: the in-app scheduler, Zapier and Make, n8n, the Graph API and AI agents, with the limits and failures of each.

How to schedule LinkedIn posts in 2026: the built-in scheduler for profiles and Pages, its limits, scheduling tools, and why the API can't schedule.

How to get an Instagram access token in 2026: Instagram vs Facebook Login, the OAuth code exchange, 60-day tokens and why there is no Instagram API key.

n8n alternatives for social media automation: Zapier, Make and Activepieces compared on pricing, self-hosting and social coverage, plus when to skip them.

Social media management software for agencies compared by pricing model (per seat, workspace or profile), plus white label, client approvals and onboarding.

A practical, step-by-step walkthrough of Meta App Review for the Instagram Content Publishing permission: real timelines, what reviewers check, and the most common rejection reasons.

What actually changes when a TikTok app passes audit — posting caps, visibility defaults, and the practical difference for a publishing integration.

A practical, request-by-request guide to migrating an Ayrshare integration to PostGate: what maps directly, what changes, and how to cut over without downtime.

What really changed with Buffer's public API for third-party developers, the current state of its new GraphQL API, and how to map a Buffer-style integration onto PostGate.

Why teams that integrated directly against the Instagram Graph API move to a unified API, and how media containers, publishing, and token refresh map onto PostGate.

7 open source social media schedulers checked on GitHub in November 2026: Postiz, Mixpost, BrightBean, Shoutrrr and more, with license, networks and stack.

PostGate has no dedicated n8n node, Make app, or Zapier app — here's how to call its REST API from each platform's own HTTP/webhook module instead, with a real working request for every tool.

We checked Postiz's public GitHub issues for TikTok posting problems instead of repeating the claim. Here's exactly what's open, what's closed, and why TikTok is the hardest platform for any self-hosted or open-source posting tool to keep working.

A sourced, honest comparison of the top social media posting and scheduling APIs in 2026 — PostGate, Ayrshare, Postiz, Blotato, Upload-Post, Zernio, bundle.social, Outstand, SocialRails, Post for Me, Post Bridge, PostProxy, and SocialBee — organized by what each one is actually best for.

Which social media APIs are actually safe for an AI agent to call — real MCP servers, draft-first confirmation, and scoped keys — compared across PostGate, Ayrshare, Blotato, Upload-Post, Zernio, bundle.social, Outstand, and more.

Social media API pricing for 11 posting APIs: entry and mid-tier plans, free tiers, what each vendor meters and the costs that are easy to miss.

A grounded, ranges-not-false-precision estimate of the engineering time and cost to build direct integrations with 5-6 major social platforms in-house — App Review timelines, per-platform build effort, and the ongoing maintenance nobody budgets for.

A genuinely balanced framework for deciding whether to build direct platform integrations in-house or buy a unified API — real scenarios where each choice wins, not just a case for PostGate.

A realistic, ranged timeline for a single Instagram Graph API publishing integration: app setup, App Review, the container-publish flow, token refresh, and testing.

App review, business verification, account-type requirements, and audit gates — which social platforms let you post publicly the moment you connect, and which ones require approval first.

Meta Advanced Access lets your app act for accounts you don't own. The checklist: Business Verification, a 30-day API call, screen recordings and App Review.

An AI agent for social media drafts, schedules and checks posts through APIs. What it can safely automate, the five parts it needs and a step-by-step build.

The Instagram API in 2026: Instagram Login vs Facebook Login, whether it is free, how to get Advanced Access, rate limits and what you can publish.

The TikTok API in 2026: which API you need, how to get a client key, whether it is free, token lifetimes, audit rules and the posting limits that matter.

Bluesky API guide for posting: app passwords vs OAuth, the createRecord call, facets, image and video limits, rate limits and how to schedule posts.

LinkedIn API pricing for posting: what is free, what needs Community Management approval, the published rate limits per tier and the token rules that cost time.

What the Model Context Protocol changes about letting an AI agent post to social media, and why draft-first, scope-limited tool design matters more than the protocol itself.

How to wire a Custom GPT Action to PostGate's OpenAPI contract, why ChatGPT's native MCP connectors need OAuth PostGate doesn't speak yet, and the safety gap you have to close yourself since POST /api/posts publishes immediately unless you say otherwise.

How to reach PostGate from Claude Desktop, claude.ai custom connectors, and the Claude API MCP connector — and why draft-first create_post plus tool-approval prompts add up to two independent safety checkpoints.

How to register PostGate as an MCP server in Claude Code with claude mcp add, and ask it to draft and schedule social posts as part of a release workflow — safely, with draft-first defaults and scoped keys.

The difference between a raw platform API, a social media management tool, and an aggregator API — and which one fits when you're building a product, not just posting for yourself.

What "programmatic" actually buys you over manual or per-platform posting — scheduling at scale, structured delivery status, and the failure modes that only show up once you're not clicking "post" yourself.

A short, plain-language definition of "social media API gateway" — what it is, how it differs from a single-platform SDK, and where PostGate fits.

What actually goes into building your own social media scheduler — OAuth token storage, a durable job queue, per-platform API quirks, idempotent retries, and per-target delivery status — plus where a managed API fits if you want to skip the hard 80%.

A practical build guide for shipping a "connect your social accounts and post" feature inside your own product: OAuth connection UI options, the actual API calls involved, and multi-tenant profile-group isolation between customers.

The honest answer: one per platform, each with its own auth model, rate limits, and media rules. A look at what "post everywhere" actually requires, platform by platform.

A plain-language definition of a social media API — what it lets you do, and how it differs from posting through each platform's own app or website.

The real mechanics behind a "schedule now, post later" button: OAuth connections, stored scheduled content, a job queue that fires on time, per-platform publish calls, and delivery status tracking.

The major platforms that offer a real, documented API for publishing content — Instagram, Facebook, TikTok, LinkedIn, YouTube, Pinterest, X, Threads, Bluesky, Mastodon, Google Business Profile, and Telegram — and what access each one actually requires.

Snapchat has no public API for organic Stories, Snaps, or Spotlight content, and Reddit's submission API is real but commercially and access-gated in ways that rule out self-serve multi-tenant use. Verified against each platform's current developer terms.

What an idempotency key is, why retried API requests need one, and how PostGate's Idempotency-Key header keeps a retried publish request from posting the same content twice.

How agencies typically price social scheduling — per-client flat fee, per-platform, or tiered by volume — and how per-client profile groups plus per-target delivery evidence make the pricing model operationally real and defensible.

Meta's Instagram content-publishing API has no scheduling parameter for any content type, Stories included — here's what that means in practice, and how a scheduling layer like PostGate's still lets you set a future time for one.

What OAuth is as a standard, how the authorize-redirect-token-exchange flow applies to connecting a social account, and how PostGate's hosted OAuth removes the callback handling and token storage from your side of it.

A verified, dated timeline of what Meta has actually deprecated or changed across the Instagram, Facebook, and Threads publishing APIs, sourced from Meta's own changelogs.

Automating posts through an API doesn't exempt you from each platform's own Terms of Service — rate limits, content policy, and anti-spam rules still apply. What that means in practice, and where PostGate's own Terms of Service already say so.

What TikTok's unaudited_client_can_only_post_to_private_accounts error means, why your customer's posts are landing as private, and how to fix it before your app passes audit.

TikTok's reached_active_user_cap is an app-level quota on unaudited clients, not a per-account problem. Here's what actually raises the cap.

instagram_basic is not deprecated, despite what most troubleshooting guides claim. What Meta actually retired, what to check instead, and the real old-to-new scope map for the permissions that did change.

Meta's OAuthException 2500 almost never means what the message implies. What Meta actually documents about this code, the widely-reported (but unconfirmed) pattern behind it during media container creation, and the fix worth trying first.

Why an Instagram media container can sit in QUEUE far longer than expected, how to tell a slow container from a stuck one, and what evidence to keep before you escalate.

What each YouTube Data API operation actually costs, why uploads and searches run out on their own separate 100-calls/day allowance instead of the shared pool, and how to request a quota increase that gets approved.

Every Instagram Graph API error code and subcode you will hit building a publishing integration, what each one actually means, and where to go for the fix.

A plain-English walkthrough of every reason a scheduled social post fails to publish, written for the marketer who has to explain it, not just the engineer who has to fix it.

What TikTok's daily active user quota error means for an unaudited client, and how it differs from the 24-hour active-user cap.

What TikTok's audit rejection reason 40 actually means, and what to fix before resubmitting.

Why TikTok rejects a video upload with file_format_check_failed, and how to confirm your file actually meets the codec/container requirements before you retry.

The real difference between these two similarly-named Instagram permissions, and which one your integration actually needs.

What Instagram Graph API error code 100 with subcode 33 means, and the most common malformed-request causes.

What error code 190 means on the Instagram Graph API, its common subcodes, and why retrying never fixes it.

What error code 9007 means for an Instagram media container, and how to tell a genuinely failed container from one that is simply not ready yet.

Facebook Graph API error codes and subcodes in tables: what 190/463, 200/2069032, 100/33 and the rate-limit codes mean, and the fix for each.

Why a silent (prompt=none) LinkedIn OAuth request fails when the previously granted scopes don't cover what you're now requesting.

The most common causes of a 403 from the LinkedIn API, and how to tell a permissions problem from a rate-limit problem.

What a 422 response from the LinkedIn API usually indicates about your request body, and how to debug it.

Why a LinkedIn connection can succeed but still be missing the w_member_social scope needed to post, and how to fix the request that asks for it.

What Threads API subcode 2207052 means and the most common trigger for it.

Why a Google OAuth refresh token stops working and returns invalid_grant, and what actually needs to happen to restore the connection (hint: it isn't just retrying).

How to read a 429 response from the X API, including the rate-limit headers that tell you when it's safe to retry.

The common causes of a failed Pinterest token refresh, and how to distinguish an expired refresh token from a revoked connection.

A practical way to classify social platform API errors — retryable vs. not, auth vs. content vs. rate-limit — instead of pattern-matching on message strings.

Why a structured, typed error envelope beats parsing free-text error messages, and what PostGate's error contract actually looks like.

How automatic OAuth token refresh should work across social platforms, and what happens when a refresh itself fails.

How Instagram's 60-day long-lived access token works, when it can be refreshed, and what happens if it expires before you do.

What actually matters when storing OAuth tokens for connected social accounts — encryption at rest, access scoping, and what PostGate does by default.

Why refresh token rotation matters for long-lived social platform connections, and the failure modes it prevents.

How to read a 429 response correctly and back off without making the underlying rate limit worse.

How to implement exponential backoff correctly for retrying social platform API calls, and why naive fixed-interval retries make outages worse.

What changes about rate-limit handling once you're publishing across hundreds of connected accounts instead of one.

How a well-built webhook consumer should handle retries, duplicate deliveries, and out-of-order events.

How signed webhook verification works and why you should never trust an unsigned payload — with a real HMAC verification example.

What a dead letter queue is for webhook delivery, and when a failed webhook should stop retrying and land there instead.

Why webhook events can arrive out of order even when nothing is broken, and how to build a consumer that keys on occurred_at instead of trusting arrival order.

A practical architecture for a job queue that reliably fires scheduled social posts at the right time, even under load.

When and why a social publishing API needs chunked media upload instead of a single request, and how it works.

How resumable upload protocols work for large video files, and why they matter for reliability on flaky connections.

Why video often needs transcoding before it can be published across platforms, and what that pipeline actually involves.

A practical ffmpeg command reference for converting video into a format Instagram Reels will actually accept.

A living reference table of accepted image and video aspect ratios across Instagram, TikTok, LinkedIn, Facebook, YouTube, and more.

Video codec, resolution, and duration requirements across every major social platform, in one reference.

The current post character limit for every major social platform, verified against each platform's own documentation.

The maximum video duration accepted by each major social platform's publishing API.

A consolidated reference for file size, format, and dimension requirements across social platform publishing APIs.

The real duration, aspect-ratio, and file-size limits for YouTube Shorts, TikTok, and Instagram Reels, the one export that clears all three, and how to publish it everywhere with a single PostGate API call.

PostGate has no dedicated bulk endpoint, so here's what scheduling in bulk actually means: looping POST /api/posts with per-row idempotency keys, realistic client-side concurrency limits, and why async per-target delivery keeps a large batch fast.

Real, source-verified social platform API changes in 2026 — Buffer, Meta, X, and LinkedIn — dated and tracked as a living reference, not a one-time roundup.

Character limits, media requirements, rate limits, and posting-frequency caps are four separate systems that all get called "limits." A short reference table for each, with links to the full breakdown.

The actual rate-limit numbers — request-count throttles, daily quotas, and points budgets — for Facebook, Instagram, Threads, LinkedIn, TikTok, YouTube, Pinterest, X, Bluesky, Mastodon, Telegram, and Google Business Profile, sourced and confidence-flagged.

How accidental double-posts actually happen — retry storms, double-clicks, timeouts — and how a stable Idempotency-Key and its 72-hour window stop them at the API.

The three retry layers in a publishing pipeline — your client, PostGate’s internal delivery, and your webhook consumer — and what each one needs to be safe to retry at any layer.

The real distributed-systems delivery guarantees, and how an idempotency key lets an at-least-once system like PostGate behave like exactly-once from your integration’s point of view.

When to subscribe to terminal webhooks and when polling GET /api/posts/{id} is the practical choice instead, per PostGate’s own delivery-lifecycle guidance.

The worst failure mode in social publishing: your tool reports success, but nothing is on the platform. Why it happens and how per-target delivery evidence catches it.

The single most common complaint about every social publishing tool, explained: what actually expires a connection, and how to tell a real disconnect from a false alarm.

The classic scheduler bug: a post scheduled in the customer’s timezone fires at the wrong hour. How it happens and how to handle timezones correctly end to end.

PostGate does not ship a multi-user approval workflow. Here is the real, honest DIY pattern teams use instead: draft: true, a review list from GET /api/posts?status=draft, and a human-triggered publish.

An HTTP 200 is not proof a post exists. What counts as real proof — a platform-issued post ID and permalink, per destination — and where PostGate attaches it to every post.

What a "receipt" for a social post attempt should contain — status, platform post ID and permalink, timestamp, and a structured error if it failed — and why the create-call response is not one.

A practical, step-by-step guide to programmatically confirming a post really landed on a platform: reading target status, checking for a permalink, and subscribing to terminal webhooks instead of trusting a 200.

PostGate’s real partial aggregate status — some targets published, some failed — and how to handle it correctly instead of rounding the whole post up to success or down to failure.