"Hosted OAuth" means exactly what it says: PostGate generates the connect URL, hosts the branded authorization page, handles the provider's callback, stores and refreshes the resulting token, and redirects your customer straight back to your product — with no OAuth callback route, no token database, and no per-platform app registration screen for you to build. One POST /api/profiles/connect call is the entire integration surface.
Your backend calls POST /api/profiles/connect with a platform and a return_url, and gets back a short-lived hosted URL — it expires in 15 minutes. Redirect your customer's browser to it; PostGate runs the provider's actual OAuth exchange and sends the browser back to your return_url with connected and connection_platform on success, or connection_error on failure. Your app never talks to Meta, TikTok, or LinkedIn's OAuth endpoints directly.
The access token never reaches your product at all — PostGate stores and refreshes it and exposes only the resulting profile. Check connection state anytime with GET /api/profiles/{id}/health, which reports status, granted scopes, expiry, and whether a reconnect is required — instead of you tracking token lifecycles per platform yourself.
By default, customers connect through PostGate's own already-registered provider apps for every platform — no Meta Business verification, no TikTok audit, no LinkedIn partner application on your side before you can offer a connect button. Bring your own provider app later, per platform, if you need isolated quotas — see white-label & BYOK.
PostGate only redirects a finished connection back to an origin you've explicitly allowed — POST /api/connect-origins. HTTPS is required outside loopback, and a workspace can register up to 25 origins.
POST /api/environments with a mode (test or live) and a brand object — product name, logo, and primary color where your plan enables them, plus a verified custom domain via PATCH /api/environments/{id} and POST /api/environments/{id}/verify-domain. Your customer sees your product name and colors on the connection screen, not PostGate's.
POST /api/profiles/connect with the platform, the profile group, and your return_url. Open the returned URL; to your customer, the whole flow looks native — they leave your product, authorize the network, and land straight back where they started.
Every PostGate plan connects customers through this same hosted flow, using PostGate's own already-approved provider apps. Branded logo and primary color, plus a verified custom domain and bring-your-own provider apps, unlock on the white-label plan once you need your customers to never see the PostGate name at all.