Connections you can defend in a security review.#
- Composio managed OAuth. The OAuth exchange runs through Composio. SignalDeck stores a reference to the connected account and the identity the provider returned, and never asks for a social password.
- Signed, expiring state. Each attempt carries state signed with HMAC-SHA256 and a random nonce. It expires after 15 minutes and must be completed by the same person in the same organization.
- Identity readback. When the connection completes, SignalDeck reads the account back from the provider, such as the Page you picked or the channel ID, and stores it as the destination identity.
- Owner or admin confirmation. Only roles that manage connections can start one. The identity must be confirmed explicitly before the destination is verified and can receive scheduled posts.
- Reconnects that change account are held. If a reconnect returns a different account, confirming it needs an owner or admin, and every scheduled post for that destination is held for re-review.
- Disable with a reason. Disabling a connection requires a reason, marks the destination disconnected, and holds its scheduled posts. History and receipts are kept.
Connection routes.#
These routes live under /api/v1 and are audited. Starting, completing, confirming, and disabling all need the connections:manage permission.
- GET /connections. List the connection registry and the toolkits that can be connected.
- POST /connections/start. Start a connection for a toolkit and get the redirect URL. Unsupported providers return 422 CAPABILITY_UNSUPPORTED.
- POST /connections/complete. Finish the attempt with its signed state and read back the account identity.
- POST /connections/:id/confirm. Confirm the identity with confirmIdentity: true. Reassigning to a different account needs an owner or admin.
- POST /connections/:id/disable. Disable the connection with a reason and hold the destination's scheduled posts.
Which accounts can be connected.#
- Connectable. Instagram Business and Creator accounts, Facebook Pages, LinkedIn member profiles, and YouTube channels.
- Disabled. X uses a separate direct writer that stays off until its review gate passes. It is not a Composio connection.
- Gated. TikTok and Pinterest lanes exist but refuse to publish, and their accounts cannot be connected yet.
- Not available. Bluesky and Google Business Profile are not in the publish registry and cannot be connected.
Questions#
- Will I ever be asked for a social password?
- No. Connections go through Composio managed OAuth. SignalDeck never asks for or stores a social password.
- Which accounts can I connect today?
- Instagram Business and Creator accounts, Facebook Pages, LinkedIn member profiles, and YouTube channels. Other providers return CAPABILITY_UNSUPPORTED when a connection is started.
- How long does a connection attempt stay valid?
- 15 minutes. After that the signed state expires and the attempt has to be started again.
- What happens if I reconnect a different account by mistake?
- Confirming a different account needs an owner or admin, and every scheduled post for that destination is held for re-review instead of going to the new account.
- Can one social account be connected to two organizations?
- No. An account already registered to another organization or workspace is rejected.