# OAuth Apps (BYOK)

Connect accounts through your own platform developer apps so consent screens show your brand.


By default, accounts connect through the Relaycast app on each platform, so the consent screen your users see names Relaycast. With **Bring Your Own Key (BYOK)** you add your own platform developer app instead. Accounts connected through it show **your** name and logo on the consent screen, and every token exchange, token refresh and publish for those accounts uses your app's credentials.

Manage apps under **Integrations → Apps (BYOK)** at [https://social-publish-kappa.vercel.app/dashboard/integrations?tab=apps](https://social-publish-kappa.vercel.app/dashboard/integrations?tab=apps). Only project owners and admins can add or delete apps.

## Supported platforms

| Platform | App credentials |
| --- | --- |
| X (Twitter) | Client ID and client secret |
| LinkedIn | Client ID and client secret |
| Instagram | App ID and app secret (Instagram Login) |
| Facebook | App ID and app secret |
| Threads | App ID and app secret |
| TikTok | Client key and client secret |
| YouTube | Google OAuth client ID and secret |
| Google Business Profile | Google OAuth client ID and secret |
| Pinterest | App ID and app secret |

Bluesky doesn't use OAuth apps, because it connects with app passwords.

## Set up an app

1. **Create an app** in the platform's developer portal (for example Meta for Developers, the X Developer Portal, LinkedIn Developers, TikTok for Developers or Google Cloud Console) and request the posting permissions you need. The [platform guides](/docs/platforms) list the scopes each platform needs.
2. In Relaycast, click **New OAuth app** and pick the platform. The form shows that platform's **callback URL**, in the form `https://social-publish-kappa.vercel.app/api/integrations/<platform>/callback`. Add it to your app's allowed redirect or callback URLs.
3. Paste your app's **client ID** and **client secret**, give the app a name, and optionally upload a logo (PNG, JPEG, WebP or GIF, up to 2 MB) to recognise it in the dashboard. Save.
4. Connect an account with **New integration** on the Integrations page and choose your app in the **OAuth app** field. That account now authenticates and publishes through your app.

> [!WARNING]
> Platforms review apps before granting publishing permissions to the public. Until your app is approved, it may only work for accounts listed as testers or developers on the app.

## How accounts use your app

- Each connected account remembers which app it was connected through. `GET /v1/accounts` returns it as `oauthAppId` (`null` means the Relaycast app).
- You can mix apps in one project: some accounts on the Relaycast app, others on yours.
- Nothing changes in the API. You post to these accounts with their `accountId` exactly as before.
- For Instagram, saved apps hold Instagram Login credentials. Connecting Instagram through Facebook Login always uses the Relaycast Facebook app.

## Secrets

Client secrets are encrypted at rest and can't be viewed again after saving. To change a secret, delete the app and add it again, then reconnect its accounts.

## Deleting an app

Deleting an app is immediate. Accounts connected through it fall back to the Relaycast app, but their tokens were issued to your app, so they'll need to be **reconnected** before they can publish again. The delete dialog tells you how many accounts are affected.