# Afilipost

Publishing infrastructure for Instagram, Facebook Pages, Threads, YouTube,
Pinterest, TikTok and LinkedIn. One post fans out to every connected account;
each destination reports its own status. Comment-to-DM automations run on the
same product. API-first: everything the panel does is a documented endpoint.

No social media password is ever asked for, shown or stored. Accounts connect
through each platform's own OAuth flow; tokens are AES-256-GCM encrypted at
rest. Free during early access; pricing, when it exists, will never be
per-connected-account.

Base URL: https://api.afilipost.com/api (same routes also answer without /api)
Auth: Authorization: Bearer yay_… (issued in the panel, shown once)
OpenAPI: https://afilipost.com/docs/openapi.json

## Endpoints

- GET  /v1/accounts?platform=instagram — connected accounts
- POST /v1/media/presign {filename, contentType, size} → {uploadUrl, publicUrl};
  PUT the file to uploadUrl, bytes never pass through the API
- POST /v1/posts {content, mediaItems[{type,url,filename,mimeType}],
  platforms[{platform, accountId, platformSpecificData}], scheduledFor,
  idempotencyKey, chain} → {post:{_id, status, platforms[{platformPostId,
  permalink, error}]}}. idempotencyKey makes retries safe.
  scheduledFor may be the literal "auto": the server picks the slot from the
  channel rhythm (gap, daily cap, day window, collision buffer), isolated per
  API key — two apps posting to one account never break each other's rhythm.
  chain: [{kind:"crossPost"|"followUp", afterMinutes, accountIds, content?,
  mediaItems?}] runs post-publish steps once the first target goes live.
- GET  /v1/posts?status=scheduled&accountId=… — list
- GET  /v1/posts/{id} — per-destination status; platformPostId is null until live
- POST /v1/comment-automations {accountId, platformPostId, keywords, dmMessage,
  buttons, commentReply, followGate} — keyword → public reply + private DM.
  followGate checks Meta's is_user_follow_business on button tap; if the flag
  is unavailable the link is sent anyway.

## Webhooks

Register endpoints in the panel. Events: post.published, post.failed,
account.expired, dm.received, comment.received. The last two close the agent
loop: your AI gets the DM event, reads /api/conversations/{id}, answers via
POST /api/conversations/{id}/send (the 24-hour window is enforced server-side).
An MCP server ships in the repo (mcp/index.mjs) exposing these as tools.
Header: X-Afilipost-Signature: t=<unix>,v1=<hex>, where v1 =
HMAC-SHA256(secret, "{t}.{raw body}"). Reject stale timestamps to prevent
replay. Three delivery attempts (0 s / 5 s / 30 s); an endpoint disables itself
after 20 consecutive failures.

## Platform limits the API surfaces honestly

- Instagram: 25 posts/account/24 h (checked before upload); DM replies allowed
  24 h after the person last wrote; a private reply to a comment is exempt.
- YouTube: daily upload quota is per Google project → per-workspace ceiling;
  over-ceiling posts defer to the next day.
- TikTok: SELF_ONLY until the app passes TikTok's direct-post audit; the API
  says so in needsManualStep.

## Tracked links

Automation button links pass through https://api.afilipost.com/r/<code>; each
click increments a counter shown per rule in the panel. Disable with
trackLinks:false on /v1/comment-automations. No personal data is collected.

## Docs

- https://afilipost.com/docs/            (quickstart, Python, no SDK needed)
- https://afilipost.com/docs/reference/  (all endpoints, real bodies)
- https://afilipost.com/docs/webhooks/   (signature verification code)
- https://afilipost.com/docs/limits/     (platform rules)
- https://afilipost.com/docs/errors/     (status codes, idempotent retry)
- https://afilipost.com/legal/privacy/   (data handling)