Developer docs
Postbase publishes to your connected social accounts over a REST endpoint and an MCP server. Both use the same API key, obey the same plan limits, and return the same per-platform results.
Authentication
Create a key under API & MCP in the console. It is shown once and cannot be recovered, so store it like a password and revoke it if it leaks. Send it as a bearer token on every request.
Authorization: Bearer pb_live_…
A key carries your full posting permissions and reaches only your own brands. Unauthenticated calls get 401; a call that would exceed your plan gets 403, refused before anything is published rather than reported as an overage afterwards.
Publishing
POSThttps://postbase.whoamie.com/api/post
{
"brand": "whoamie",
"platforms": ["instagram", "facebook", "linkedin"],
"text": "Shipped.",
"mediaUrl": "https://…/image.jpg", // optional, required for Instagram
"mediaKey": "uploads/…/f3a1.mp4" // optional, from POST /api/uploads
}The response reports every platform separately. ok is the overall result; a platform that failed carries its own error.{
"ok": false,
"results": [
{ "platform": "instagram", "ok": true, "id": "1789…4021" },
{ "platform": "facebook", "ok": true, "id": "1043…_8891" },
{ "platform": "linkedin", "ok": true, "id": "urn:li:share:74984…" },
{ "platform": "tiktok", "ok": false, "error": "tiktok publishing needs a video upload flow that isn't implemented yet" }
]
}curl -X POST https://postbase.whoamie.com/api/post \
-H "Authorization: Bearer pb_live_…" \
-H "Content-Type: application/json" \
-d '{"brand":"whoamie","platforms":["linkedin"],"text":"Shipped."}'Reading
GET/api/brands
GET/api/accounts
GET/api/usage
{
"plan": "pro",
"planLabel": "Pro",
"postsThisMonth": 412, "postsLimit": 2500,
"meteredPostsThisMonth": 18, "meteredPostsLimit": 60,
"brands": 4, "brandsLimit": 10
}GET/api/activity
MCP
Postbase is an MCP server, so an AI agent can publish as a tool call. There are two ways to connect one, and which applies is decided by the client rather than by you.
By URL, with OAuth
For clients that add a connector by address — Claude’s Add custom connector dialog and anything else that speaks the MCP authorization spec. Paste https://postbase.whoamie.com/mcp and nothing else: there is no field for a key in those dialogs, and there does not need to be. The client registers itself, sends you here to sign in and approve, and receives its own token.
Approved clients are listed under Keys in the console and can be revoked there, which cuts them off immediately without touching your API keys.
By config, with an API key
For clients configured from a file — Claude Code, Claude Desktop, Cursor — and for anything with no browser to send a person to, such as a server or an n8n AI Agent node.
{
"mcpServers": {
"postbase": {
"type": "http",
"url": "https://postbase.whoamie.com/mcp",
"headers": { "Authorization": "Bearer pb_live_…" }
}
}
}Both reach the same endpoint with the same three tools and the same permissions. The difference is only how the caller came by its credential.
Three tools are exposed:
- list_brands: brands and their connected platforms. Worth calling before posting, so the model targets something that exists.
- post: same arguments as the REST endpoint, brand, platforms, text, optional mediaUrl and mediaKey.
- usage: posts used this month against the plan.
Scheduling
Posts can go out immediately or be queued. The console asks who the post is for rather than what timezone to use: pick an audience and it offers times that are already correct for those readers, shown both on their clock and on yours.
Suggested times are per platform, because they differ. LinkedIn peaks around the professional working day and is quiet at the weekend. Instagram and TikTok peak in the evening. A post going to both is offered slots for each, labelled with which platform it suits. You can always pick an exact time instead.
A queued post can be cancelled or moved from the Scheduled page. Moving cancels the original and queues a replacement, so the identifier changes.
Scheduling is a console feature. The REST API and MCP publish immediately, on the assumption that a caller with its own scheduler does not need ours.
Platform notes
- Instagram requires mediaUrl. It publishes images, not text-only posts. That URL has to be publicly downloadable: Instagram and Facebook fetch it from their own servers, so signed URLs that expire, share pages from Google Drive or Dropbox, and anything behind a login will fail. Upload through mediaKey instead if the file is not already hosted somewhere public.
- Facebook posts to a Page, so the connection has to have one selected. Text goes to the feed, an image to photos, a video to videos.
- LinkedIn posts to the personal profile of whoever connected the account. Company Pages are not supported, including Pages you administer — publishing as an organisation requires LinkedIn’s Community Management API, a reviewed product this app has not been granted. It also publishes text only for now: an attached photo or video is not sent with it.
- X is the only platform that costs money per post, so it has a separate monthly allowance on every plan. Posts carrying a link cost substantially more than plain text at X’s own rates.
- Telegram uses a bot token rather than OAuth. Add the bot to your channel as an admin, then connect it under Accounts.
- TikTok and YouTube connect today, and publishing is coming with the chunked video upload flow. Until then, including either in platforms returns a per-platform error rather than failing the whole call, as in the response above.
- When TikTok does land, it will send the video to the creator’s TikTok drafts to finish and post there. Publishing straight to a TikTok profile needs a separate grant from TikTok that this app does not hold.
Errors
- 401: missing, malformed, revoked or expired key.
- 403: the call would exceed a plan limit, or the account is not approved yet. Nothing was published.
- 404: no such brand, or that platform is not connected to it.
- 200 with "ok": false: the request was valid and at least one platform refused. Read results.
Something missing or wrong here? Tell us, or see the Terms and Privacy Policy.