Turn approved products into reviewable social drafts, keep privacy checks in front of publishing, and connect platform accounts using protected server-side credentials.
Planning placeholder only. It is not used on product pages, social posts, Open Graph cards, or structured data.
No credentials required
Platform Preview & Media Preflight
Check a proposed caption, destination link, and image before social API credentials are approved. This tool runs in the browser and does not publish, save, upload, or change product records.
Enter the proposed content, then run the preflight. Results are advisory and do not replace platform review, media consent, or the Social Media Privacy Guard.
These public pages and direct HTTPS callback routes now exist. Provider callbacks are readiness endpoints only until secure OAuth start, state validation, encrypted token storage, refresh, and disconnect controls are enabled.
Pinterest verification:p:domain_verify is included in the head of every HTML page, including the home page.
Connection guide
What “connected” means
A pixel is tracking, not publishing. Meta Pixel/CAPI, Pinterest Tag, TikTok Pixel, and Google/YouTube tags measure visits and conversions. To create an organic post, each platform also needs its own developer app, authorization permissions, account/page identity, and server-side token. Put secrets in Cloudflare only; never paste them into product forms, Git, browser JavaScript, or the D1 database.
1. Meta: Facebook Page + Instagram
Create a Meta developer app, add the Facebook Login/Graph API products required for your access model, and set the exact production redirect URL only if using OAuth later.
Ensure the Facebook Page is managed by the Meta account and that Instagram is a Professional account connected to that Page.
Request only the permissions the app needs. Page publishing normally needs Page management/posting access; Instagram publishing needs the publishing permission for the connected business/creator account.
Use Graph API Explorer or your app’s token flow to obtain a Page access token, then identify the Page ID and Instagram professional account ID.
In Cloudflare Pages → Settings → Variables and Secrets, add encrypted secrets: FACEBOOK_PAGE_ID (or META_PAGE_ID), FACEBOOK_PAGE_ACCESS_TOKEN (or META_PAGE_ACCESS_TOKEN), INSTAGRAM_USER_ID/INSTAGRAM_BUSINESS_ACCOUNT_ID, and optionally INSTAGRAM_ACCESS_TOKEN. Set META_GRAPH_API_VERSION only after reviewing that version.
Optionally add META_APP_ID and META_APP_SECRET to let the server test Page-token validity, app ID, expiry, data-access expiry, and returned scopes. Secret values are never returned to the browser.
Return here and select Test Facebook + Instagram. Confirm HTTP 200, Page/account identity and configured ID match. This read-only test does not publish.
After the credential tests pass, dry-run a product draft, complete privacy/media/caption review, then publish one non-sensitive product-only test post and save its provider ID/URL.
The current app supports Facebook Page image/link posts and Instagram single-image feed posts through its review-first queue. Reels, carousels, and video uploads need their own tested media path before being automated.
2. X
Create an X developer project/app and enable OAuth user authentication with write capability.
Use OAuth 2.0 Authorization Code with PKCE or an approved account-token method. Request at least tweet.read, tweet.write, and users.read; add offline.access only when you implement secure token refresh.
Store a valid user posting token as the encrypted Cloudflare secret X_USER_ACCESS_TOKEN.
Dry-run a short post first. The app trims X copy to its platform limit and sends text/link posts only; it does not upload media to X in this build.
3. Pinterest
Create a Pinterest developer app and choose OAuth access suitable for creating Pins on your own business account.
Authorize the account with the pin/board scopes needed for the boards you will use. Select a board dedicated to Devil n Dove product discovery.
Save encrypted Cloudflare secrets PINTEREST_ACCESS_TOKEN and PINTEREST_BOARD_ID.
Use an HTTPS public product image and product landing URL. Dry-run before creating the first Pin.
4. TikTok
Create a TikTok for Developers app and request the Content Posting API scopes appropriate to your goal: Direct Post needs the approved video.publish scope; upload-only needs video.upload.
Build and approve the required user OAuth flow, then query creator info before rendering a post/export experience.
Use a tested video/photo transfer flow and respect the creator’s account/video limits.
Keep TIKTOK_ACCESS_TOKEN encrypted in Cloudflare only after the dedicated flow exists.
TikTok remains manual/review-first here. The queue can prepare captions/media, but it intentionally does not attempt Direct Post until that required OAuth/upload implementation is complete.
5. YouTube
Create a Google Cloud project, enable YouTube Data API v3, configure the OAuth consent screen, and create web-app OAuth credentials.
Implement an OAuth flow requesting https://www.googleapis.com/auth/youtube.upload for video upload.
Use resumable upload, record the returned video ID/URL, and set privacy deliberately. New unverified projects may have upload restrictions.
Keep refresh/access tokens encrypted in Cloudflare, never in the browser or D1.
YouTube remains preparation/manual-review only in this build; a real upload must use the dedicated resumable upload flow.
6. Measurement and campaigns
Install browser tags only after consent and privacy policy review: Meta Pixel/CAPI, Pinterest Tag, TikTok Pixel, and Google Analytics/YouTube measurement as appropriate.
Use the social queue’s UTM fields. Product drafts use utm_source=devilndove_social, utm_medium=social, and a campaign such as new_product.
Review visits, checkout starts, custom requests, and post attempts in the existing social queue analytics before spending on ads.
How a new product becomes a social post
Product is saved as Active and Approved/Published, with a usable product image.
When the “Create a social draft” setting above is enabled, the app creates one draft linked to that product.
Open the queue to review copy, media, platform choices, UTM link, duplicate warning, and Social Media Privacy Guard result.
Approve/ready the queue item, dry-run the platform payload, then use Publish only for configured platforms. TikTok and YouTube stay manual until their required upload/OAuth implementation is completed.
Important: Automatic drafting is enabled only by your admin setting. Automatic publishing is deliberately not enabled, because every final post can expose names, addresses, private workshop details, customer information, copyright-protected material, or an unfinished product claim.
No credentials required
Platform Preview & Media Preflight
Check a proposed caption, destination link, and image before social API credentials are approved. This tool runs in the browser and does not publish, save, upload, or change product records.
Enter the proposed content, then run the preflight. Results are advisory and do not replace platform review, media consent, or the Social Media Privacy Guard.