Getting social media API access is rarely a coding problem. Writing the code to publish a post is the easy part, and getting permission to run it is where projects stall, and the requirements differ so wildly between platforms that experience with one teaches you almost nothing about the next.
Some networks hand you a token in thirty seconds. Others require a business entity, a recorded screencast of your app, and a review that can take weeks and be rejected.
One will let you publish immediately but silently make every post private until you pass an audit.
This is what each platform actually asks for, and roughly how long it takes.
Agencies hit these approval requirements per client, which our agency workflow guide covers.
The Approval Difficulty Table
| Platform | Approval needed | What gates it |
|---|---|---|
| Telegram | None | Message BotFather, get a token |
| Discord | None | Create a webhook in channel settings |
| Bluesky | None | App password on any account |
| Light | Trial access immediately, apply for standard | |
| YouTube | Light | Project + OAuth consent; extra quota by request |
| X (Twitter) | Light | Developer account, then buy credits |
| Heavy | Professional account, linked Page, App Review | |
| Heavy | App Review, business verification | |
| Heavy | Product request, some permissions partner-only | |
| TikTok | Heavy | Audit, or every post is private |
The full limit figures for each are in our rate limits comparison. The split is roughly: platforms that see an API as infrastructure make it easy, and platforms that see it as a distribution risk make it hard.
The three easiest are also the three where publishing is least commercially sensitive.
No Approval Needed: Telegram, Discord, Bluesky
Start here if you are prototyping, because you can be publishing within minutes.
Telegram. Message @BotFather, send /newbot, receive a token. Add the bot to your channel as an administrator with permission to post. No OAuth, no review, no fee. Full walkthrough in our Telegram API guide, and BotFather's own setup instructions cover the basics.
Discord. Open the channel, Edit Channel, Integrations, Webhooks, New Webhook, copy the URL. That URL is the entire credential. No bot or application required for publishing, per the Execute Webhook reference. See our Discord API guide.
Bluesky. Generate an app password in account settings and authenticate against the AT Protocol, as covered in our Bluesky API guide and on the Bluesky scheduler page. Its rate limits are published openly, and there is no review process at all.
If your project only needs to reach one of these, do not build against the harder platforms first. Prove the workflow where approval is free.
The hardest of the mainstream networks to get publishing access to, and the requirements compound.
You need an Instagram professional account (Business or Creator). A personal account cannot publish through the API at all. Depending on how the account is connected, Instagram may also require a linked Facebook Page: it is required with Facebook Login, while the Instagram API with Instagram Login does not need one.
Permissions depend on your login method. With Instagram Login you need instagram_business_basic and instagram_business_content_publish. With Facebook Login you need instagram_basic, instagram_content_publish and pages_read_engagement, plus ads_management and ads_read if you have been granted a Page role.
Once approved you still have to keep the connection alive, which our OAuth guide covers. Anything beyond your own accounts requires App Review, where you submit a screencast demonstrating each permission in use and explain why you need it.
Reviews are commonly rejected for a vague use case or a screencast that does not clearly show the permission being exercised.
There is also Page Publishing Authorization: if the connected Page requires PPA, it must be completed before publishing works, which catches people out because the API error does not obviously say so.
Once through, publishing is capped at 100 API-published posts within a 24-hour moving period per account, as covered in our rate limits comparison. Meta's Instagram platform documentation is the authoritative source for all of the above, though it blocks automated fetching, so we are not linking a URL we cannot verify resolves.
Similar machinery to Instagram, since both run on Graph API. You need a Facebook App, App Review for the publishing permissions, and business verification for anything at scale.
Two hard limits worth knowing before you plan around them. Personal profiles cannot be published to via the API: Meta removed that capability years ago and has not replaced it.
Groups are effectively closed too, with access so restricted that most developers find API-based Group posting impractical.
So "post to Facebook" in practice means "post to a Facebook Page", which our Facebook scheduler handles directly. Our Facebook API guide covers the Page token flow and the review process in detail.
Skip the approval gauntlet. PostEverywhere already holds approved apps on every network we support, so connecting an account takes an OAuth click rather than a review cycle. See the API docs.
TikTok
TikTok has the most surprising gotcha in this entire guide, and it costs people weeks.
You register an app, add the Content Posting API product, enable Direct Post, and get the video.publish scope approved. At that point your code works, posts succeed, and the API returns success responses.
But per TikTok's own Content Posting API documentation: "All content posted by unaudited clients will be restricted to private viewing mode." Every post is forced to privacy_level: "SELF_ONLY", visible to nobody but the creator.
To publish publicly, your API client must pass an audit verifying compliance with TikTok's developer terms. Only then do PUBLIC_TO_EVERYONE and MUTUAL_FOLLOW_FRIENDS become available.
Our TikTok scheduler publishes through an already-audited client, so this does not arise. This is the single most common "my TikTok integration works but nobody can see the posts" cause. Nothing errors. The posts are simply private.
Budget for the audit from the start rather than discovering it after launch.
Access is organised around products you request for your app in the Developer Portal, not a single review.
For publishing you need w_member_social to post as a member, or w_organization_social to post as an organization. The organization permission is further restricted: the authenticated member must hold an ADMINISTRATOR, DIRECT_SPONSORED_CONTENT_POSTER or CONTENT_ADMIN role on the company page, per the Posts API documentation.
Some permissions are gated harder. r_member_social, for retrieving a member's posts, is marked "restricted" and "available to approved users only", which in practice means the partner programme.
Two operational details that bite. Every request needs a Linkedin-Version header in YYYYMM format, and versions are sunset on a schedule, so an integration left alone will eventually break. And rate limits are not published: you look yours up in the portal's Analytics tab, which only shows endpoints you have already called.
YouTube
Comparatively painless. Create a Google Cloud project, enable the YouTube Data API, configure an OAuth consent screen, and you can upload.
The friction is quota rather than approval. The default allocation is 10,000 units per day, with separate allowances of 100 videos.insert calls and 100 search.list calls per day, per Google's quota cost documentation. For publishing that is generous.
Our YouTube scheduler covers the publishing side. The catch is the OAuth consent screen. While your app is in testing mode it is limited to a small number of test users, and moving to production requires verification if you use sensitive scopes, which uploading does.
That verification is the YouTube equivalent of App Review, and it is the step people forget to budget for.
X (Twitter)
Straightforward to get access, and then you pay for it.
Register a developer account and create an app. There is no meaningful review for basic posting. What has changed is the commercial model: access is now pay-per-usage credits rather than a monthly tier, per X's pricing documentation.
You buy credits up front and each call deducts from the balance. Creating a post costs $0.015, and $0.200 if it contains a link, which is the figure that dominates any marketing workload. We work through the arithmetic in X API pricing.
So X inverts the usual pattern: easy to be approved, expensive to operate. The X scheduler avoids the per-call meter entirely.
A two-stage model that is unusually transparent. New apps get trial access immediately: 1,000 requests per day overall and 300 per day for pin creation. You can build and test straight away.
Standard access is granted on application and raises limits substantially, to 100 requests per second overall and 100 per minute for pin creation, per Pinterest's rate limits reference.
The important consequence: do not judge Pinterest's API by trial limits. An integration that feels unusably throttled in development is usually fine in production.
How Long This Really Takes
A realistic plan for a multi-platform integration, assuming nothing goes wrong.
Day one: Telegram, Discord and Bluesky are all publishing. Pinterest and X are working on trial access and credits respectively. YouTube works for your own test account.
Week one to two: LinkedIn products requested. Instagram and Facebook App Review submitted. TikTok audit submitted. YouTube OAuth verification submitted if you need production access.
Week two to six: reviews come back. Some are rejected and need resubmission with a clearer screencast or use case. TikTok's audit determines whether your posts have been public or private this whole time.
Ongoing: LinkedIn version headers need updating before sunset dates. Meta permissions occasionally require re-review. Any platform can change its requirements with little notice.
That is the part rarely budgeted for. The build is days; the approvals are weeks; the maintenance never stops. Our comparison of social media APIs covers which route makes sense for which project, and the scheduling API guide covers what you have to build on top once access is granted.
If the publishing is incidental to your product rather than the point of it, a unified API removes the approval work entirely, because the approved apps already exist. The same applies to agents: our connectors and agent framework guide both assume publishing access is solved.
Publishing to several networks? One OAuth click per account, no app review, no audits. From $9/mo with a 7-day trial and card required. See pricing or browse connectors.
FAQ: Social Media API Access
Which social media APIs need approval to publish?
Instagram, Facebook, LinkedIn and TikTok all require a review, audit or product request before you can publish on behalf of others. Telegram, Discord and Bluesky require no approval at all.
YouTube, X and Pinterest sit in between, needing a developer account and, for YouTube, OAuth verification for production use.
Why are my TikTok API posts private?
Because your API client has not passed TikTok's audit. TikTok's documentation states that all content posted by unaudited clients is restricted to private viewing mode, forcing privacy_level to SELF_ONLY.
Nothing errors and the API returns success, so the only symptom is that nobody can see the posts. Passing the audit unlocks public privacy levels.
What do I need to publish to Instagram via the API?
You need an Instagram professional account (Business or Creator); depending on how the account is connected, Instagram may also require a linked Facebook Page. Permissions then depend on your login method: instagram_business_basic and instagram_business_content_publish with Instagram Login, or instagram_basic, instagram_content_publish and pages_read_engagement with Facebook Login.
Publishing for accounts other than your own requires App Review, and Page Publishing Authorization must be completed if the connected Page requires it.
Can I post to a personal Facebook profile via the API?
No. Meta removed that capability and has not replaced it, so API publishing is limited to Pages. Group access is also heavily restricted, to the point that most developers find API-based Group posting impractical.
Any tool claiming to publish to personal profiles is not doing so through the official API.
How long does social media API approval take?
Plan for two to six weeks across the harder platforms, assuming no rejections. Meta App Review commonly takes one to two weeks per submission, and rejections are frequent enough to plan a second attempt.
TikTok's audit and LinkedIn's product requests run on their own timelines. Telegram, Discord and Bluesky are same-day.
Do I need a registered company to get API access?
For the easy platforms, no. For Meta at scale, business verification requires a legal entity and supporting documentation. LinkedIn's restricted permissions effectively require a partner relationship. TikTok's audit assesses your app and its compliance rather than your company specifically, but a real product and a working privacy policy are expected.
What is the fastest way to start publishing programmatically?
Telegram or Discord. Both take minutes, need no OAuth flow and no review, and cost nothing. They are the right place to prove a publishing workflow before committing to platforms where approval is measured in weeks.
Can a scheduling tool bypass API approval?
It does not bypass approval so much as absorb it. A publishing platform holds its own approved applications on each network, so connecting your account is an OAuth grant rather than a review submission.
The approvals still exist; they were completed once by the tool rather than repeatedly by every customer.
Founder & CEO of PostEverywhere. Writing about social media strategy, publishing workflows, and analytics that help brands grow faster.
