TrackPost — Documentation

Getting started

1. Create and verify one Cloud account. 2. Select or create the organization that owns the integration. 3. Create a project for the website, shop or brand whose data must stay together. 4. Open the product workspace and confirm that it is enabled before copying credentials or sending production traffic.

That is the complete account setup. The remaining sections are implementation guides. Credentials are always project-scoped; server secrets must never be placed in browser code, public repositories or client-side environment variables.

Connect a destination before publishing

Open TrackPost → Connections and connect at least one account you are authorized to use. Select the displayed destination in the post or API request; TrackPost prevents publishing to unavailable or unauthorized destinations.

Connect publishing accounts

Once enabled, each user can connect the Facebook Pages, Instagram professional accounts, Threads profiles, Google Business locations, LinkedIn profiles or LinkedIn organization pages they are authorized to publish through. The OAuth callback imports eligible accounts as stable connection IDs; applications never collect provider access tokens themselves.

A LinkedIn member target remains bound to the person who connected it. Provider availability and permissions are validated per connection.

Create a TrackPost API key

Open TrackPost → API. An organization owner or administrator creates a named key; the complete tp_live_ token is shown once and must be stored in a server-side secret manager. The same panel displays the exact project endpoint plus every usable platform and connection ID. Keys expire and can be revoked.

Publish or schedule with post.publish

POST one post.publish event to the endpoint displayed in the workspace using Authorization: Bearer <token>. eventId is the integration's stable idempotency identifier. post accepts text, an HTTPS link, an HTTPS media URL or a combination; destinations contains 1–25 objects with the selected platform and exact connectionId. scheduledAt is optional and uses an ISO-8601 timestamp.

Accepted platform values are facebook, instagram, threads, google_business and linkedin. TrackPost verifies that every platform matches the stored connection. A platform name alone never publishes to every account. Existing integrations may keep the legacy targets string array, but a request must use exactly one of destinations or targets.

curl --request POST "$TRACKPOST_API_URL" \
  --header "Authorization: Bearer $TRACKPOST_API_KEY" \
  --header "Content-Type: application/json" \
  --header "X-Request-Id: release_2030_001" \
  --data '{
  "eventId": "blog_release_2030_001",
  "type": "post.publish",
  "scheduledAt": "2030-01-15T14:00:00.000Z",
  "post": {
    "text": "Our new article is live.",
    "linkUrl": "https://example.com/blog/article"
  },
  "destinations": [
    {
      "platform": "linkedin",
      "connectionId": "CONNECTION_ID"
    }
  ]
}'

Channel cases and scheduling

A single event creates one delivery per target. Instagram professional publishing requires suitable media. Immediate requests begin processing after acceptance; future scheduledAt values remain queued for the scheduler. Organization-owned links receive TrackAny.Click campaign parameters when that cross-product measurement is enabled.

Social media with AI agents

An agent may prepare channel-specific text and media references, but it should hand the final structured post.publish payload to an authorized server workflow. Keep content generation, human review, target selection and publication as separate auditable steps; never give the API key or provider tokens to browser-side agent code.

Approval and idempotency

Only send after the responsible reviewer has approved the exact content and targets. Repeating the same eventId with the same key returns the existing post as status=duplicate. Store requestId, postId, status and publishAt; never create a new eventId merely because a response timed out.

Responses, failures and measurement

A new plan returns HTTP 202; an idempotent replay returns HTTP 200. Correct 400 invalid_request, 401 invalid_token, 403 permission and 409 idempotency_conflict errors before retrying. Respect Retry-After on 429 and use bounded backoff for transient 503 errors.

TrackAny.Click parameters on owned links measure visits and downstream outcomes, not proof that a post was viewed. Publishing status and website attribution remain separate signals.