Engineering · Postiz series, part 2 of 2
Facebook, Instagram, and TikTok
The three platforms where OAuth setup meets review queues and business-account plumbing — and the development-mode shortcut that lets a small team skip most of the waiting when posting to its own accounts.
This is part 2 of a two-part series on running Postiz, the open-source social scheduler, on your own server.
- Part 1: X, LinkedIn, Reddit, and Mastodon
- Part 2: Facebook, Instagram, and TikTok (you are here)
Part 1 connected four channels with nothing but portal clicks. The remaining three are a different sport. The clicks aren't harder — the platforms are simply gated: Meta wants business accounts linked to Pages linked to apps, TikTok wants your app audited before posts go public, and both dangle a review queue between you and "Live."
The escape hatch, and the single most useful fact in this post: development mode is not a demo mode. An unreviewed Meta app posts perfectly well — to accounts that have a role on that app. If the accounts you're scheduling for are your own (that's us: we market Remotype, Remotext, and Foldyni, all house accounts), you may never need to click "Submit for review" at all.
Meta: one app, two channels
Facebook and Instagram share a developer portal, and one app serves both.
- Go to developers.facebook.com → My Apps → Create App. Pick the Business type.
- In App settings → Basic, copy the App ID and App Secret — these fill four env vars (Postiz keys the two channels separately):
FACEBOOK_APP_ID=...
FACEBOOK_APP_SECRET=...
INSTAGRAM_APP_ID=...
INSTAGRAM_APP_SECRET=...
- Add the Facebook Login for Business product, and under its settings set Valid OAuth Redirect URIs to both callbacks:
https://postiz.example.com/integrations/social/facebookhttps://postiz.example.com/integrations/social/instagram
- In App roles, add every account that will connect a channel as an admin or tester. This is what makes development mode work — role-holders can OAuth against an unreviewed app.
The platform rule that surprises people: the API posts to Pages, not profiles. Personal-timeline posting was removed years ago, platform-wide. Your Facebook presence for a product is a Page, and the account connecting it in Postiz needs admin on that Page. During the connect flow, Meta will ask which Pages to grant pages_manage_posts and pages_read_engagement on — grant them for the Pages you schedule to.
Two hard prerequisites, both on Instagram's side rather than the API's:
- The Instagram account must be a Business or Creator account (Settings → Account type). Personal accounts are invisible to the posting API.
- It must be linked to a Facebook Page (Instagram Settings → Sharing to other apps, or from the Page's settings).
Once linked, the same Meta app and the same consent flow light Instagram up in Postiz. If the connect dialog shows no Instagram account to pick, the Page link is what's missing — it's always the Page link.
When you do need review
Development mode covers posting to accounts with app roles. You need Live mode — app review, business verification, screencasts of your use case — only when other people's accounts will connect through your app. Building a tool for clients, yes. Marketing your own products, no. Skip it until the day your answer changes.
TikTok
TikTok's gate is an audit rather than a business graph.
- Register at developers.tiktok.com → Manage apps → Connect an app.
- Add the Login Kit and Content Posting API products.
- Set the redirect URI:
https://postiz.example.com/integrations/social/tiktok. TikTok insists on HTTPS and verifies the domain — there's a verification file or DNS record step in the portal; do it, it's five minutes. - Copy the Client key and Client secret:
TIKTOK_CLIENT_ID=...
TIKTOK_CLIENT_SECRET=...
The gotcha that reads like a bug but is policy: until your app passes TikTok's audit, everything it posts is forced private (visible to the posting account only, as a draft or self-only video). Credentials work, uploads succeed, and then the video sits where nobody can see it. If you want public posts via the API, request the Content Posting API audit from the app's console — for a legitimate scheduler use case it's a form and some patience, not a Meta-scale review.
The full board
With part 1's four channels, your .env now carries seven credential pairs. Recreate one last time:
docker compose up -d
Then connect Facebook, Instagram, and TikTok from Add channel — each should walk through consent and land as a connected account. Seven networks, one calendar, on your own hardware. Drafts queue on a Tuesday night, fan out on Thursday morning, and nobody on the team has opened seven browser tabs to do it.
That's the entire promise of self-hosting Postiz: the marketing load becomes one more service in the compose file — backed up, documented, and rebuildable like everything else you run. It's how a team our size ships Remotype, Remotext, and Foldyni and still shows up on seven platforms every week.