Channels and official APIs
Platforms
www.onfleeksocial.com · Instagram · Facebook Pages · TikTok · YouTube
on fleek Social publishes to four channels. The accounts and channels belong to the companies we work for — independent businesses with their own logins to the application. An account is only ever connected through the platform's own OAuth dialog: whoever is signed in there — the account holder themselves or a team member they have authorised — grants the permission explicitly and can withdraw it at any time.
Every platform is addressed through its official API: the Meta Graph API for Instagram and Facebook Pages, the TikTok Content Posting API for TikTok, and the YouTube Data API v3 for YouTube. There is no other route inside the application — no scraping, no automated browser sessions, no stored platform passwords.
The four channels in detail
For each channel: which post types the application publishes, through which API, how the connection comes about, and which data is read in the process.
Post types: image, carousel, reel and story. Stories are published without interactive elements — no stickers, links or polls.
API: Meta Graph API, content publishing for Instagram Business and Creator accounts. Meta fetches the media file itself; for that, the application provides a short-lived, signed address for that one file.
Connection: OAuth consent by the account owner. In the Meta dialog they decide which accounts to release and see the permissions being requested (among them instagram_basic, instagram_content_publish and instagram_manage_insights).
What is read: the name, profile picture and follower count of the connected account, plus — for the brand voice analysis — the texts of the most recently published posts on that account. The metrics of the account (reach, impressions, interactions) are intended for a later analytics feature; the instagram_manage_insights permission is requested when connecting. They are not retrieved at present.
Facebook Page
Post types: image, carousel, video, reel, link post and story on the Facebook Page of the customer.
API: Meta Graph API, using the Page token that results from the consent given by the Page administrator.
Connection: the same OAuth dialog as for Instagram. The account owner picks the individual Pages the application is authorized for; the permissions include pages_show_list, pages_manage_posts, pages_read_engagement and read_insights. Pages that are not released stay invisible to the application.
What is read: the name, Page picture and fan count of the released Pages, plus the texts of the most recently published posts on the Page — for the brand voice analysis and, after an interrupted send, to recognise a post that already went out instead of sending it a second time. The metrics of the Page (reach, impressions, interactions) are intended for a later analytics feature; the pages_read_engagement and read_insights permissions are requested when connecting. They are not retrieved at present.
TikTok
Post types: videos and photo posts.
API: TikTok Content Posting API. Videos are uploaded in chunks directly from our server (FILE_UPLOAD). Photo posts are only accepted via a URL (PULL_FROM_URL): for those the application provides a short-lived, signed address per image — the same mechanism as for Meta — which TikTok fetches itself.
Connection: OAuth consent by the account owner with the scopes user.info.basic, video.upload and video.publish. Each account is set to one of two routes. Draft (video.upload): the post is delivered to the TikTok inbox of that account and the account owner finishes publishing in the TikTok app itself — visibility and commercial disclosure are set there, not by our application. Direct post (video.publish): before anything is sent, the editor selects the visibility from exactly those levels TikTok reports back for that account and states whether the post is branded content or a self-declared commercial statement. These declarations are passed on to TikTok unchanged.
What is read: the display name and profile picture of the connected account, the publishing options reported by TikTok, and the status of our own upload. The application does not request a permission for TikTok analytics.
YouTube
Post types: vertical Shorts and regular videos.
API: YouTube Data API v3, uploaded as a resumable transfer in chunks. Title, description and visibility are set by the application during the upload.
Connection: Google OAuth by the channel owner with the scopes youtube.upload and youtube.readonly.
What is read: the name, channel picture and subscriber count of the connected channel, plus the processing and privacy status of the videos the application uploaded itself.
What the application does not do
These limits are drawn in the code — there is no way to reach any of these things from the interface.
- No content from other accounts: posts and statistics of other accounts are neither retrieved nor displayed. The one exception is the location lookup for Instagram place tags: there, Meta’s page search returns the public names and addresses of places as a pick list for the editor — no posts, no metrics, and nothing is stored beyond the ID and the name of the location that was picked.
- No embedding of platform content on websites: the application serves no feeds, widgets or embedded posts for third-party sites.
- No automated interactions: no likes, no following or unfollowing, no automatically written comments or direct messages.
- No sharing of platform data with third parties: data from the connected accounts is not sold, not traded, and not used for advertising or profiling.
- No publishing outside the approval path: a post leaves the application only from the statuses “approved” and “scheduled”, and only through a single checked transition function. Where an approval requirement is agreed with a client company, the approval is given by the customer in their own login — or, where a company has explicitly delegated this to us, by the on fleek team on their behalf. Every status change is recorded with person and time. There is no code path that publishes past that.
Revoking a connection
The account owner stays in control of the connection — permanently, not just at the moment of the first click. It can be ended at any time in the security or app settings of the account in question at Meta, TikTok or Google. A message to us is equally sufficient; we then disconnect the account inside the application.
If we disconnect the account inside the application, the stored access and refresh tokens are deleted from our database in that same step. If the authorization is revoked directly at Meta, TikTok or Google, the application detects this on its next health check, marks the account as failed and stops all sending; the token, worthless by then, is deleted as soon as we disconnect the account — one message to us and that happens right away. In either case, all that remains is the history of the posts already published — without any access to the account.
Questions about a connection or about revoking one?
on fleek GmbH · Industriestr. 10 · 92360 Mühlhausen · Germany. Write to us if you would like a linked account disconnected or want to know which data we hold for an account.