In short
Secure Social Relay integrations use HTTPS only, store platform API keys in a secret manager, never embed keys in browsers, send Idempotency-Key on publish, verify webhook HMAC signatures, and map customers to profiles without IDOR.
Must do
- HTTPS only for API and webhook endpoints
- Platform keys server-side only
- Idempotency-Key on every POST /api/v1/posts
- Validate before publish in production UIs
- Verify X-Social-Restapi-Signature
- Map customers → profiles without cross-customer IDOR
- Handle 402, 429, quota_exceeded, duplicate_content, and partial posts
- Optional TOTP on dashboard owners who manage keys
Rate and fair use
About 300 requests/minute per API key. Network quotas (Instagram ~50/24h, LinkedIn ~150/24h, Facebook Reels ~30/24h) are per connected account. Duplicate text within 48h is rejected. Optional daily token budget: GET/PATCH /api/v1/billing/limits. Full detail: guide “API limits and fair use” and dashboard Docs → Errors and rate limits.
What Social Relay commits to
Tenant isolation by platform and application, hashed application-scoped API keys, encrypted OAuth material, structured errors without secret leakage, and audit trails for support correlation.