WBP LogoWBP Social Command Center
Sign inGet started
Developer Platform ComplianceLast Updated:

Developer & API Terms of Use

This document outlines the technical standards, authentication architecture, rate-limit policies, and platform compliance guidelines governing WBP Social Command Center's integration with third-party social media APIs.

Developer Integration Standards & Principles

WBP Social Command Center is engineered with enterprise security, strict privilege separation, and respectful API consumption patterns. We strictly utilize official, documented REST/GraphQL endpoints provided by each platform and never employ unofficial scraping, reverse-engineered private APIs, or credential interception.

1. Authentication & OAuth 2.0 Architecture

All integrations with external social media networks operate under the following security protocols:

  • Proof Key for Code Exchange (PKCE): Whenever supported by the platform, OAuth 2.0 Authorization Code grant is augmented with PKCE to prevent authorization code interception attacks.
  • State Parameter & CSRF Defense: Every OAuth initiation generates an unguessable cryptographic state token, validated upon callback to prevent Cross-Site Request Forgery.
  • Principle of Least Privilege: We request only the minimal scopes strictly necessary to execute the features selected by the user (e.g., publishing to specific pages, reading analytics). We do not request full account ownership or broad personal messaging permissions.
  • Encrypted Credential Storage: Access and refresh tokens are stored in private database tables with Row-Level Security (RLS) and encrypted at rest using AES-256.

2. Platform-by-Platform API Scopes & Purpose

Below is the comprehensive technical breakdown of official APIs, authentication methods, and specific permissions utilized by WBP Social Command Center:

Meta (Facebook Graph API & Instagram Graph API)

Graph API v19.0+
Auth Method: OAuth 2.0 with Granular Scopes
Scope Footprint: 6 permission scopes
Requested Scopes:
pages_show_listpages_read_engagementpages_manage_postsinstagram_basicinstagram_content_publishinstagram_manage_insights
Purpose & Functional Usage:

Allow users to connect authorized Facebook Pages and Instagram Professional/Creator accounts to compose, schedule, publish image/video/carousel posts and Reels, and retrieve publishing health metrics.

Google & YouTube Data API

YouTube Data API v3
Auth Method: Google OAuth 2.0 with PKCE
Scope Footprint: 3 permission scopes
Requested Scopes:
https://www.googleapis.com/auth/youtube.uploadhttps://www.googleapis.com/auth/youtube.readonlyhttps://www.googleapis.com/auth/userinfo.profile
Purpose & Functional Usage:

Upload user-composed video content and YouTube Shorts, schedule publication times, set metadata (title, description, tags, category), and review video performance metrics. Strictly adheres to Google API Services User Data Policy Limited Use requirements.

LinkedIn Developer Platform

LinkedIn Consumer & Community Management APIs
Auth Method: OAuth 2.0 Authorization Code Flow
Scope Footprint: 6 permission scopes
Requested Scopes:
openidprofileemailw_member_socialw_organization_socialr_organization_social
Purpose & Functional Usage:

Publish text, image, and video updates to LinkedIn personal profiles and authorized Company Organization Pages, and monitor post status.

TikTok for Developers

TikTok Content Posting API & Display API
Auth Method: TikTok OAuth 2.0
Scope Footprint: 3 permission scopes
Requested Scopes:
user.info.basicvideo.publishvideo.upload
Purpose & Functional Usage:

Enable creators and brands to schedule and publish authorized short-form video assets directly to their TikTok account.

Pinterest Developer Platform

Pinterest API v5
Auth Method: OAuth 2.0 Bearer Authentication
Scope Footprint: 4 permission scopes
Requested Scopes:
boards:readboards:writepins:readpins:write
Purpose & Functional Usage:

Create and schedule pins with titles, descriptions, destination links, and media assets to targeted user boards.

X (formerly Twitter Developer API)

X API v2
Auth Method: OAuth 2.0 with PKCE
Scope Footprint: 4 permission scopes
Requested Scopes:
tweet.readtweet.writeusers.readoffline.access
Purpose & Functional Usage:

Publish user-composed posts, threads, and media attachments to X, and verify connection status.

Reddit Developer Platform

Reddit Data API
Auth Method: OAuth 2.0 (Script/App)
Scope Footprint: 3 permission scopes
Requested Scopes:
identitysubmitread
Purpose & Functional Usage:

Publish formatted community announcements and content submissions to subreddits where the authenticated user has posting authority.

3. Rate Limiting, Throttling & Retry Backoff

To prevent platform overload and protect our shared API quota, WBP Social Command Center implements strict client-side and server-side rate limits:

  • Exponential Backoff with Jitter: In the event of 429 (Too Many Requests) or 5xx server responses from a social platform API, our queue workers automatically back off exponentially with randomized jitter to prevent thundering herd problems.
  • Header Inspection: We monitor platform rate limit headers (such as `X-RateLimit-Remaining` or Meta's `X-Business-Use-Case-Usage`) and proactively pause subsequent requests before quotas are exhausted.
  • Fair-Share Workspace Queues: Workspaces have throttled publishing slots ensuring no individual user can monopolize third-party API capacity.

4. Webhook Security & Real-Time Updates

Where supported (such as Meta Webhooks for Instagram comments or user data deletion notices), our ingress endpoints verify HMAC SHA-256 signatures generated with shared app secrets before processing any event payload. Unsigned or invalid requests are rejected immediately with HTTP 401 Unauthorized.

5. Developer App Review Contact

Platform app reviewers, compliance auditors, or partner engineers requiring sandbox access, test credentials, or clarification on our API usage may contact our engineering lead:

WP Bulk Publishing — Developer Relations

Direct Contact: Wpbulkpublishing@gmail.com

We respond to all developer audit inquiries within 24 business hours.