Channels and official APIs
Platforms
www.social.9of.de · Instagram · Facebook Pages · TikTok · YouTube
on fleek Social publishes to four channels. The accounts and channels belong to the companies we work for — independent businesses with their own logins to the application. An account is only ever connected through the platform's own OAuth dialog: whoever is signed in there — the account holder themselves or a team member they have authorised — grants the permission explicitly and can withdraw it at any time.
Every platform is addressed through its official API: the Meta Graph API for Instagram and Facebook Pages, the TikTok Content Posting API for TikTok, and the YouTube Data API v3 for YouTube. There is no other route inside the application — no scraping, no automated browser sessions, no stored platform passwords.
The four channels in detail
For each channel: which post types the application publishes, through which API, how the connection comes about, and which data is read in the process.
Post types: image, carousel, reel and story. Stories are published without interactive elements — no stickers, links or polls.
API: Meta Graph API, content publishing for Instagram Business and Creator accounts. Meta fetches the media file itself; for that, the application provides a short-lived, signed address for that one file.
Connection: OAuth consent by the account owner. In the Meta dialog they decide which accounts to release and see the permissions being requested (among them instagram_basic, instagram_content_publish and instagram_manage_insights).
What is read: the name, profile picture and follower count of the connected account, plus — for the brand voice analysis — the texts of the most recently published posts on that account.
Metrics: once every night the application reads the follower count and the number of posts of the account, plus the likes and comments of every post published through the application in the last 30 days; that is what the reporting in the agency view and in the client view is built from. If an account hides its likes, Instagram does not return the value — the metric then stays empty. Reach and impressions are not retrieved: the instagram_manage_insights permission requested for them when connecting is on hold in the ongoing Meta review.
Facebook Page
Post types: image, carousel, video, reel, link post and story on the Facebook Page of the customer.
API: Meta Graph API, using the Page token that results from the consent given by the Page administrator.
Connection: the same OAuth dialog as for Instagram. The account owner picks the individual Pages the application is authorized for; the permissions include pages_show_list, pages_manage_posts, pages_read_engagement and read_insights. Pages that are not released stay invisible to the application.
What is read: the name, Page picture and fan count of the released Pages, plus the texts of the most recently published posts on the Page — for the brand voice analysis and, after an interrupted send, to recognise a post that already went out instead of sending it a second time.
Metrics: once every night the application reads the fan count of the Page through pages_read_engagement, plus the likes, comments and shares of every post published through the application in the last 30 days; that is what the reporting in the agency view and in the client view is built from. Reach and impressions are not retrieved: the read_insights permission requested for them when connecting is on hold in the ongoing Meta review.
TikTok
Post types: videos and photo posts.
API: TikTok Content Posting API. Videos are uploaded in chunks directly from our server (FILE_UPLOAD). Photo posts are only accepted via a URL (PULL_FROM_URL): for those the application provides a short-lived, signed address per image — the same mechanism as for Meta — which TikTok fetches itself.
Connection: OAuth consent by the account owner with the scopes user.info.basic, video.upload and video.publish. Each account is set to one of two routes. Draft (video.upload): the post is delivered to the TikTok inbox of that account and the account owner finishes publishing in the TikTok app itself — visibility and commercial disclosure are set there, not by our application. Direct post (video.publish): before anything is sent, the editor selects the visibility from exactly those levels TikTok reports back for that account and states whether the post is branded content or a self-declared commercial statement. These declarations are passed on to TikTok unchanged.
What is read: the display name and profile picture of the connected account, the publishing options reported by TikTok, and the status of our own upload. The application does not request a permission for TikTok analytics.
Metrics: none. TikTok releases no figures through the permissions in use — neither for the account nor for individual posts. The nightly sync therefore does not touch TikTok accounts at all, and the reporting states on the account card that there are no metrics for TikTok instead of showing zeros.
YouTube
Post types: vertical Shorts and regular videos.
API: YouTube Data API v3, uploaded as a resumable transfer in chunks. Title, description and visibility are set by the application during the upload.
Connection: Google OAuth by the channel owner with the scopes youtube.upload and youtube.readonly.
What is read: the name, channel picture and subscriber count of the connected channel, plus the processing and privacy status of the videos the application uploaded itself.
Metrics: once every night the application reads the subscriber count, the channel views and the number of videos of the channel from the statistics fields of the Data API, plus the views, likes and comments of every video published through the application in the last 30 days. YouTube only publishes the subscriber count in rounded form, so the history moves in steps. Reach, impressions and watch time are missing: they would come solely from the YouTube Analytics API, and its yt-analytics.readonly permission is not approved for this application.
What the application does not do
These limits are drawn in the code — there is no way to reach any of these things from the interface.
- No content from other accounts: posts and statistics of other accounts are neither retrieved nor displayed. The one exception is the location lookup for Instagram place tags: there, Meta’s page search returns the public names and addresses of places as a pick list for the editor — no posts, no metrics, and nothing is stored beyond the ID and the name of the location that was picked.
- No embedding of platform content on websites: the application serves no feeds, widgets or embedded posts for third-party sites.
- No automated interactions: no likes, no following or unfollowing, no automatically written comments or direct messages.
- No sharing of platform data with third parties: data from the connected accounts is not sold, not traded, and not used for advertising or profiling.
- No publishing outside the approval path: a post leaves the application only from the statuses “approved” and “scheduled”, and only through a single checked transition function. Where an approval requirement is agreed with a client company, the approval is given by the customer in their own login — or, where a company has explicitly delegated this to us, by the on fleek team on their behalf. Every status change is recorded with person and time. There is no code path that publishes past that.
Revoking a connection
The account owner stays in control of the connection — permanently, not just at the moment of the first click. It can be ended at any time in the security or app settings of the account in question at Meta, TikTok or Google. A message to us is equally sufficient; we then disconnect the account inside the application.
If we disconnect the account inside the application, the stored access and refresh tokens are deleted from our database in that same step. If the authorization is revoked directly at Meta, TikTok or Google, the application detects this on its next health check, marks the account as failed and stops all sending; the token, worthless by then, is deleted as soon as we disconnect the account — one message to us and that happens right away. In either case, all that remains is the history of the posts already published — without any access to the account.
Questions about a connection or about revoking one?
on fleek GmbH · Industriestr. 10 · 92360 Mühlhausen · Germany. Write to us if you would like a linked account disconnected or want to know which data we hold for an account.