How Postbean connects to your accounts
Esta página aún no está disponible en tu idioma.
Postbean never asks for, sees or stores your social media passwords.
How it works
Section titled “How it works”- You start a connection from Connections in Postbean.
- Your browser is sent to that network’s own login screen — instagram.com, google.com, linkedin.com, and so on.
- You sign in there, on the network’s page, and it shows you exactly what Postbean is asking permission to do.
- You approve, and the network issues an access token.
- You come back to Postbean, which stores that token encrypted and uses it to publish.
Your password stays between you and the network. Postbean only ever holds a token that the network issued and can revoke.
What Postbean asks for
Section titled “What Postbean asks for”Only what it needs to work: publishing posts, reading back the basic metrics on what it published, and — where the network allows it — leaving the first comment. Nothing about reading your DMs or your followers.
Declining a permission does not break the connection; it removes the feature that needed it.
The two exceptions
Section titled “The two exceptions”Two networks do not offer OAuth for this, and both have their own safer-than-a-password mechanism:
- Bluesky uses an app password you generate in Bluesky’s settings, scoped to one app and revocable on its own. Never use your real Bluesky password.
- DEV Community uses an API key from your DEV account settings.
Revoking access
Section titled “Revoking access”Two ways, and both work immediately:
- From Postbean — the ⋮ menu on the account in Connections, then disconnect.
- From the network — Instagram’s Apps and websites, Meta’s Business integrations, Google’s Third-party apps with account access, LinkedIn’s Permitted services, and the equivalents elsewhere.
Deleting your Postbean account removes every stored token as well. See Data deletion.
Only official APIs
Section titled “Only official APIs”Every network is reached through its official, documented API. Postbean does not scrape, does not automate a browser session, and does not use unofficial endpoints. That is why some things are not possible — LinkedIn Company Pages, Instagram trial reels — and it is also why your accounts are not at risk from using it.