Connecting social accounts the right way: OAuth, encryption, and manual-confirm posting

Every social integration is a trust boundary. When a user connects their X or Facebook account, they're handing your app the ability to speak as them. Treat that credential like a password, because that's exactly what it is.

We request the narrowest permissions that do the job — for Facebook, Page-posting scopes only, never personal-profile access. The connect flow uses each platform's OAuth 2.0 dialog, so the user grants access on the platform's own screen and can revoke it there any time. We never see or store a password.

Access and refresh tokens are encrypted with AES-256 before they touch the database, and only decrypted server-side at the moment of a posting action. If a platform invalidates a token, the integration is marked expired and the user is prompted to reconnect — there's no silent retry with a dead credential.

This is the rule that makes the whole thing safe to run: nothing posts automatically. A draft is generated, queued, and then a person opens the Post Now panel, reads the preview and character count, and clicks confirm. No cron job, no routine, no agent reaches the live-post endpoint. The automation fills the queue; a human sends it.