Platform posting requirements: which social APIs require approval before you can go public
App review, business verification, account-type requirements, and audit gates — which social platforms let you post publicly the moment you connect, and which ones require approval first.
By André LugApproval gates before public API posting vary widely: Meta platforms (Facebook Pages, Instagram, Threads) require App Review — plus Business Verification for Pages and a Business/Creator account for Instagram; YouTube requires an API compliance audit; Pinterest requires Standard-access review; LinkedIn organization posting requires a partnership. TikTok posts without approval but unaudited clients publish private-only. Bluesky, Mastodon, and Telegram have no review gate.
This is a different question from "what file format does the API accept" — it's "can I even post publicly yet." Several major platforms let an app publish the moment OAuth completes; several others require a formal review, business verification, or a specific account type before a post is visible to anyone but you. Getting this wrong is why teams build an integration, test it successfully on their own developer account, and then discover it can't post to a real customer until an approval process — sometimes weeks long — clears.
PostGate handles OAuth, publishing and delivery evidence for every network through one API. Start free or read the docs.
Approval gates by platform
| Platform | Gate before public posting | What's actually required |
|---|---|---|
| Facebook Pages | App review + business verification | Pages only (no personal timeline posting); Meta App Review for the pages_manage_posts permission, plus Business Verification on the app's Business Manager. |
| Account type + app review | Business or Creator account only — personal accounts can't use the Content Publishing API at all. App Review is required for the publishing permission; see Meta App Review for Instagram Content Publishing. | |
| Threads | Meta review | Same Meta App Review process family as Facebook/Instagram, scoped to the Threads API's own publishing permission. |
| Partner access for organization pages | Posting as a member works with standard OAuth. Posting as an organization/Company Page requires LinkedIn's Community Management API partnership — not available on self-serve developer access. | |
| TikTok | Audit tier gates reach, not the endpoint itself | The Content Posting API itself works without a per-request approval. But an unaudited client can only publish as private, and is capped at 5 newly-connected TikTok accounts per rolling 24 hours — see TikTok audited vs. unaudited client. Creator info and disclosure fields are required on every post regardless of audit status. |
| YouTube | API compliance audit | A YouTube Data API compliance audit is required for public and unlisted uploads on most integrations. Separately, channels without phone verification are capped at 15-minute videos and a rolling daily upload limit. |
| Standard access review | Trial access works immediately at low volume; Standard access — the tier with real production-level rate limits — requires Pinterest's own review process. See Pinterest API Standard Access Approval. | |
| X (Twitter) | Developer app with OAuth 1.0a | Requires a registered X developer app with OAuth 1.0a enabled specifically — the newer OAuth 2.0 client credentials aren't accepted by the reliable chunked media-upload path. No content-review gate beyond that for posting itself. |
| Google Business Profile | API access request | Google Business Profile API access itself is a request-and-approval process, separate from standard Google Cloud OAuth — a project isn't granted meaningful quota until Google approves the access request. |
| Bluesky | None | App-password connection; no platform-side review or approval process to post. |
| Mastodon | None (decentralized) | No central approval authority — each instance sets its own registration and posting rules, but there's no platform-wide review gate comparable to Meta's or TikTok's. |
| Telegram | None beyond bot admin rights | Create a bot via BotFather and add it as an administrator of the destination channel or group — no platform-wide review process. |
What are the two different kinds of gates?
An app-level review (Meta App Review, a YouTube compliance audit, TikTok's audit) is about the app itself — does it handle user data responsibly, does it do what it claims. It happens once, is often slow, and unlocks capability for every account the app later connects. An account-level requirement — Instagram's Business/Creator account type, LinkedIn's organization-page partnership — is about the specific account being posted to, and no amount of app review changes it. A fully-reviewed app still can't post to an Instagram personal account, and a fully-reviewed LinkedIn app still can't post as an organization without separate partner access.
How does PostGate surface this?
PostGate's platform capability matrix marks each platform's publishing state explicitly as available, approval_required, or sandbox, so an integration can check whether a target is actually clear to post publicly before attempting delivery — instead of discovering an approval gap only after a real customer's post fails.
Frequently asked questions
Can I post to TikTok via the API without an audit?
Yes — TikTok's Content Posting API works without a per-request approval. But an unaudited client can only publish as private, and is capped at 5 newly-connected TikTok accounts per rolling 24 hours. Creator info and disclosure fields are required on every post regardless of audit status, so passing the audit is what unlocks public reach, not the endpoint itself.
What is the difference between app-level review and account-level requirements?
An app-level review — Meta App Review, a YouTube compliance audit, TikTok's audit — is about the app itself: it happens once, is often slow, and unlocks capability for every account the app later connects. An account-level requirement — Instagram's Business/Creator account type, LinkedIn's organization-page partnership — is about the specific account being posted to, and no amount of app review changes it.
Which platforms require no approval to post via API?
Bluesky (an app-password connection, with no platform-side review), Mastodon (decentralized — each instance sets its own registration and posting rules, but there is no platform-wide review gate), and Telegram (create a bot via BotFather and add it as an administrator of the destination channel or group). Everything else on the list carries some form of review, verification, or partnership gate.
Can an API post to a personal Instagram account?
No. Only Business or Creator accounts can use Instagram's Content Publishing API — personal accounts cannot use it at all, and a fully-reviewed app still cannot post to one. App Review is additionally required for the publishing permission even for supported account types.
Does LinkedIn require approval to post via the API?
It depends on the author. Posting as a member works with standard OAuth and no special approval. Posting as an organization or Company Page requires LinkedIn's Community Management API partnership, which is not available on self-serve developer access — a fully-reviewed app still cannot post as an organization without it.
