Connect accounts safely

The text-only, owner-triggered publisher is deployed, but all 27 X connection records are expired and none includes tweet.write. Fresh authorization, API credits as required, and an exact-account proof are still required; media upload remains disabled.

• Owner: create a confidential Web App in the X Developer Console; callback: https://nwsqyuucwzihruszocge.supabase.co/functions/v1/twitter-oauth.
• Posting: add tweet.write and reauthorize; media upload remains disabled in the first release.
• Cost: X uses pay-per-use credits.

Eligible Business or Creator accounts can publish through Meta. The publisher is deployed and 25 fresh linked-Instagram connections have write scope, but posting remains preview/approval gated and no current-release provider proof has run.

• Owner: convert to professional, link the Page, add assets to Meta Business, and complete app review.
• Permission: instagram_content_publish; comments/insights are separate.
• Official Meta Instagram workspace

Official automation is for Pages the signed-in member administers—not personal profiles. The publisher is deployed and 25 fresh Page connections have write scope, but posting remains preview/approval gated and no current-release provider proof has run.

• Owner: create or select the Meta Business app in the Meta App Dashboard, then select the exact Page.
• Permission: pages_manage_posts for publishing; engagement is separate.
• Pages API reference: Getting started and access tokens; Page posts documentation. These explain the API; app configuration happens in the dashboard above.

MyPersonas implements only Upload-to-inbox with video.upload. Direct Post and unattended public scheduling are disabled; the owner finishes every uploaded draft in TikTok.

• Owner: follow TikTok's current app registration guide, add policy URLs, and submit the use case.
• First proof: one designated Upload-to-inbox with provider-status polling, then finish or discard it in TikTok.
• Open the exact TikTok readiness steps above

Uploads use YouTube Data API v3 and youtube.upload. The safe connector proof is a private upload to the exact bound channel.

• Owner: enable YouTube Data API v3 in Google Cloud, configure OAuth, and complete the YouTube audit.
• Open the exact YouTube readiness steps above

Member posting uses Share on LinkedIn. Organization/Page posting needs a qualifying Page role and Community Management access.

• Owner: create the app at LinkedIn Developers and associate the Page.
• Permission: w_member_social for member posts; the portal's current approved organization scope is authoritative.

No conventional app review, but MyPersonas still needs a security-complete OAuth connector and AT Protocol publisher.

• Owner: authorize the correct account after client metadata and callback are live.
• MyPersonas: PKCE, PAR, DPoP, refresh rotation, secure keys, record publishing, and revocation.
• Official OAuth guide

Threads publishing requires a Meta app, its own OAuth connector, review for production users, and threads_content_publish.

• Owner: add Threads to the Meta app and add the callback once implemented.
• Official Threads API workspace

The Public Profile API is allowlist-only. Personal Snapchat automation is not supported.

• Owner: create a Public Profile and OAuth app in Snap Business Manager, then apply for allowlist access.
• Official setup

Devvit can submit as a user only after a clear, separate owner action. Reddit explicitly disallows unattended user actions.

• Owner: create a Devvit project, request only submit permissions, publish, and complete approval.
• Commercial use: may require a separate Reddit agreement.
• User-action rules

The exact-channel webhook.incoming connector is deployed, but production has zero Discord credential and connection rows. Automating a normal user account is prohibited.

• Owner: create the application in the Discord Developer Portal, add the exact discord-oauth callback, and use the official webhook.incoming channel consent. Do not create or paste a bot token.
• Open the exact Discord readiness steps above
• OAuth and permissions

Use a bot as an administrator in the intended channel or group; do not treat a personal Telegram login as normal web OAuth.

• Owner: create the bot through BotFather and grant only needed rights.
• Telegram Bot API

WhatsApp Business Platform supports business customer messaging, not social-feed publishing or personal WhatsApp management.

• Owner: create a WhatsApp Business Account/number, add Cloud API, configure webhooks, templates, review, and billing.
• Official Cloud API collection

The deployed connector reads the authorized identity, campaigns, and existing campaign posts, then offers an exact-preview handoff to Patreon's native editor. It does not implement member details, webhooks, Patreon Live, or provider-side post creation.

• Owner: register a client in the Patreon portal.
• Posting: use Patreon's native scheduler through manual handoff.
• Open the exact Patreon readiness steps above

The deployed connector covers channel details, eligible schedule segments, and announcements—not a general social-feed/video-upload publisher.

• Owner: register an app in the Twitch Developer Console.
• Choose an action: channel information, schedule segments, and announcements have separate permissions.
• Open the exact Twitch readiness steps above

Kick's API covers channel updates, chat, events, rewards, moderation, and live information—not ordinary feed publishing.

• Owner: create the app at Kick Dev.
• Official public API reference

No public upload API was located. Stage files and metadata here, then use Rumble's native uploader/scheduler.

• Official upload guide
• The documented Live Stream API is read/overlay data, not publishing authorization.

OAuth, report scans, exact approval plans, labels/archive/recoverable Trash, and Undo are implemented.

• Owner: add each exact address under Google Auth test users, then press Connect Gmail.
• Callback: https://nwsqyuucwzihruszocge.supabase.co/functions/v1/gmail-oauth.
• Production: complete OAuth verification/security review as Google requires.

A delegated Microsoft Graph connector and Entra app must be built before a real Connect Outlook button can work.

• Owner: register an app in Microsoft Entra for work and personal Microsoft accounts.
• Start: Mail.Read; add Mail.ReadWrite only for approved cleanup. Do not add Mail.Send.

Safe access needs a dedicated encrypted IMAP worker. Never put a Yahoo password or app password in the ledger.

• Owner, after the worker exists: create a Yahoo app password and enter it only in encrypted secret entry.
• IMAP: imap.mail.yahoo.com:993 with SSL.

Use Apple's supported third-party authorization when available, otherwise an app-specific password in the future encrypted worker.

• Owner: enable 2FA and follow Apple's app-specific password instructions.
• IMAP: imap.mail.me.com:993 with SSL.

Requires a paid plan, Proton Bridge on a trusted always-on computer, and a local MyPersonas companion.

• Owner: install Proton Mail Bridge locally.
• Never expose Bridge ports to the internet.

This is a category, not a provider. Record the real service—such as Mailchimp, Kit, beehiiv, or another sender—so its official API can be evaluated.

• Do not reuse a mailbox password as newsletter authorization.
• Sending remains off until that provider's connector, consent, audience rules, and unsubscribe handling pass.

Use the implemented Wix external app-install flow, then bind the exact site and author. A Wix sign-in elsewhere is not MyPersonas authorization.

• Owner: create the app in Wix Custom Apps, request Manage Blog + Read Members, and create a Share Install Link if it is unlisted.
• First proof: create and read back a Wix Blog draft with publishing off.
• Open the exact Wix readiness steps above

WordPress.com and self-hosted WordPress need different authorization. A saved website URL is neither one.

• Owner: identify the exact site, authorize only content writing, and select the author/byline when needed.
• First proof: create and read back a Draft, then open WordPress Preview. Private, Publish, and Schedule are not part of this proof.
• Open the exact WordPress readiness steps above

Record the actual host or CMS. WordPress, Shopify, Squarespace, Webflow, WooCommerce, and custom sites each need their own official route.

• A saved URL is not authentication.
• Domain, DNS, billing, checkout, legal, destructive, and major production changes stay owner-approved.

A Seller App can manage an eligible owner's shop; broader seller access requires Etsy review.

• Owner: register at Etsy Developers with an active shop in good standing.
• Start: listings_r and listings_w; add other scopes only for approved features.

Amazon Associates plus the Creators API can provide approved product/link data. It does not authorize retail-account operation or social posting.

• Owner: enroll in Amazon Associates, meet current eligibility, keep marketplace Partner Tags, and register for Creators API.
• Creators API

Reply access is disabled by default and requires a claimed business plus Yelp Partner approval.

• Owner: claim the listing at Yelp for Business and apply for Respond to Reviews access.
• Official reply API requirements

Requires a Trustpilot for Business account and API module; multi-business integrations use the partner route.

• Owner: confirm the paid module/entitlement and Business Unit ID.
• Trustpilot developer start

An official MCP path exists, but capability depends on the authorized service and documents. MyPersonas has no connector.

• Default: inventory/manual only unless you choose a narrow document workflow.
• Filings, signatures, purchases, account changes, and legal decisions remain owner-controlled.
• Official LegalZoom MCP information

No public general seller gig/order/message-management API was located.

• Stage gig copy, images, FAQs, offers, and replies from text you supply.
• Open Fiverr, review, publish/send manually, and mark complete.
• Official prohibited-services guidance

No public official developer/account-management API was located. Do not use passwords, cookies, session copying, scraping, auto-DMs, or unofficial login automation.

• Safe workflow: stage media/caption/link, approve, open the media handoff, copy the package, open OnlyFans, publish in its signed-in interface, then mark posted.
• Use a native scheduler only if the current signed-in interface offers it.
• Draft replies only from message text you paste or explicitly supply.

Signal has no supported hosted account-management API for this use and prohibits bulk/automated messaging.

• Paste or supply message text for a draft, review it, and send it yourself.
• Signal terms

Steam Web APIs cover public data and approved publisher operations, not general consumer-account/social management.

• Steam Web API overview

PlayStation Partners is for game development/publishing. Personal PSN account management stays manual.

• PlayStation Partners

Xbox services APIs are title/game services, not a consumer social-account manager.

• Xbox services API introduction

Nintendo's developer program is for game development/publishing. Consumer account management stays manual.

• Nintendo Developer Portal

Epic Online Services supports a developer's game integration, not a general Epic consumer-account manager.

• Epic Accounts & Social

Record the real provider and public account URL. MyPersonas will check for an official API, eligibility, review, pricing, and terms before enabling anything.

• Until that review is complete, use the manual handoff and never store credentials in the record.