Product updates

What changed at PostLake

Product updates for the social media API built for AI agents. Built in public for the people and agents who rely on it.

New

A complete integration workspace for SaaS products

Developers can now create customer profiles, generate scoped social connection links, and manage optional customer-owned OAuth credentials from one workspace.

  • Managed PostLake OAuth remains the default. One server-side API key can safely operate many customer profiles without exposing the key in a browser.
  • Connection links can return each customer to the integrating product after OAuth and can be limited to selected networks.
  • Customer-owned OAuth credentials are optional and encrypted. They only change the app identity shown during network consent.
  • The TypeScript SDK now documents the multi-user integration pattern and supports agent, source, approval, network, and date filters when listing posts.

Open the integration guide Read the API docs

Improved

Agent docs now list all nine networks as live

llms.txt and the docs twins no longer tell models that only five networks are connectable or that the rest are rolling out. Agents should treat every listed network as connectable and publishable.

  • All nine networks are connectable and publishable: X, LinkedIn, Instagram, TikTok, Facebook, Threads, Bluesky, YouTube, and Pinterest.
  • Feature depth (inbox, engage, discovery) still varies by network. Read live limits from get_platform_capabilities or GET /v1/platforms instead of inventing unavailable.
  • X publishing still needs a paid plan or credit pack. Every other network works on free credits.

Agent index (llms.txt) Platform support

New

Connect links that return to your app after OAuth

Mint a hosted connect link that sends the browser back to your app after OAuth, scoped to one profile so one customer's channels cannot leak into another's.

  • POST /v1/connect-link now accepts returnUrl and platforms. After OAuth the browser lands on your origin with connect_status, platform, and profile.
  • A profile-scoped connect link keeps that profile after OAuth. Disconnect, analytics, and GET /v1/social-accounts?profile= stay in the same bucket.
  • DELETE /v1/social-accounts/{id} and the account.disconnected webhook cover teardown. GET /v1/me/limits reports per-profile and workspace rate envelopes. Paid plans raise both.

Let users connect social accounts Connect link API

Improved

Rate limits are per profile, with a workspace ceiling

A product with many end users no longer shares one publish bucket across every customer. Each Channels profile gets its own API and publish cap, and the workspace ceiling rises with the plan so many users can burst at once.

  • Free and credit packs: 120 API calls and 12 publishes per minute per profile, 2,400 / 180 across the workspace. Standard, Pro and Business raise both layers.
  • Pass profile on reads, or publish with that profile's acc_ ids, so one customer cannot spend another's headroom. MCP create_post uses the same buckets as REST.
  • Network caps stay separate. TikTok's own 6 requests a minute per account still return rate_limited on that target. Scheduled fires still use one Durable Object alarm per post.

Let users connect social accounts Account limits

New

Every API key is now an agent identity

Named API keys now appear in Agent Control with their own attribution and enforceable publishing authority, bringing unattended agents into the same control plane as OAuth agents.

  • Owners can restrict each key to selected profiles and networks, set a daily cap, require approval, and control purchased-credit use.
  • Posts and drafts created with a key retain that key's identity in activity history.
  • Existing keys keep their current publishing access unless an owner adds restrictions, so working integrations continue without interruption.

Manage API keys Authentication guide

Improved

Homepage now names the social infrastructure

The homepage keeps Stop posting. Let your agents do it. Underneath it now says PostLake is the social infrastructure for AI agents, not only a posting API.

  • Hero, FAQ and llms.txt now describe observe, publish, engage and measure as one layer.
  • Code samples on the homepage match the live contract: profile plus platforms, Idempotency-Key, published state, post.published webhooks, and the postlake TypeScript SDK.

Read the homepage Definition for agents

New

Owners can require approval from an agent

A PostLake owner can now require human approval on an OAuth-connected agent. Publish requests from that agent become drafts automatically, and the same agent cannot approve its own work.

  • The rule is enforced by the API, not left to a prompt.
  • Drafts retain the agent identity and appear as awaiting approval in agent activity.
  • OAuth agents can no longer mint unrestricted API keys that bypass their limits.

Set up human approval

Improved

A faster, clearer Inbox

Switching between conversations now reuses a preloaded thread instead of waiting for a second request. The Inbox also keeps conversation context visible, including the connected profile that receives and sends each message.

  • Threads preload when a person points, focuses, or presses a conversation.
  • Rich Instagram collaboration requests are preserved instead of collapsing to no text.
  • The message workspace keeps its own scroll areas, so the rest of the page stays fixed.

Read about the Inbox API

New

Agents can run more of the social workflow

The hosted MCP server now documents the full operational surface: connection handoff, publishing, asynchronous post confirmation, unified Inbox actions, discovery, moderation, and analytics.

  • Agents can confirm an asynchronous publish before a final public URL is available.
  • Direct-message threads can be explicitly marked read after they are handled.
  • Every tool is documented in the MCP guide and the agent-readable llms.txt reference.

Connect the MCP server Read the MCP docs

Improved

A safer path from agent to channel connection

An agent can now give the account owner a signed connection link when a social network requires a human to approve access. The owner completes the social sign-in, while the agent stays out of passwords and consent screens.

  • Connection links are scoped, signed, and short-lived.
  • The same workflow works from the dashboard, REST API, and hosted MCP server.

How agents connect channels

For implementation detail, integration changes, and planned work, see the documentation or contact support.