White-label social account connect

What white-label means here

Connecting a social account is OAuth. At some point the user must see the platform's own login and consent screen. No posting API can hide that, and you shouldn't want it to: it's what makes the connection safe. What you control is everything before and after.

The flow

1. The user clicks Connect Instagram in your app.
2. Your backend calls POST /v1/accounts/connect with platform, external_id (your user ID) and redirect_url.
3. You redirect the user to the returned url.
4. They log in on Instagram and approve.
5. They land back on your redirect_url.
6. Your backend lists the user's accounts with GET /v1/accounts?external_id=user_123.

const r = await fetch("https://ugcapi.dev/v1/accounts/connect", {
  method: "POST",
  headers: {
    "Authorization": "Bearer " + process.env.UGCAPI_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    platform: "instagram",
    external_id: "user_123",
    redirect_url: "https://yourapp.com/settings/accounts",
  }),
});
const { url } = await r.json();
return Response.redirect(url, 302);

Choosing external IDs

• Use a stable internal ID, not an email. Emails change.
• For agencies, use the creator ID, or a 'client:creator' pair if the same creator works with several clients.
• Use the same external_id on posts so results map back without extra lookups.

Design the screens around it

• Before the redirect, tell users what will happen: 'You'll log in with Instagram and approve posting.'
• For Instagram, say up front it needs a Business or Creator account. It saves a failed connect.
• For Facebook, explain they'll choose which Pages to connect.
• After the redirect, show the connected account's name and avatar right away.
• Show a Reconnect button when you get an account.disconnected webhook.

Sending links outside your app

Agencies and creator networks often send connect links by email or DM, since creators don't log in to their tools. The same call works: create a link per creator per platform and send it. Set redirect_url to a simple thank-you page.

Your own platform apps

The platform's consent screen shows the name of the platform app that requests access. With UGC API, that is our app. If you need your brand there, you need your own TikTok, Meta and Google apps, with their reviews. Read doing it yourself vs UGC API for that tradeoff.

Full request and response details are in connect accounts. For how generator apps use this, see UGC generator apps.

Security notes

• Create connect links on your server. Never put your API key in the browser.
• Treat the redirect_url landing as a signal, not proof. Confirm the connection by listing accounts from your server.
• Generate a fresh link each time. Don't reuse an old link in a newsletter.
• Let users disconnect from your app with DELETE /v1/accounts/:id, and tell them they can also revoke access in the platform's settings.

These steps keep the flow simple for users and keep your key and accounts safe.

One more detail: account types. Instagram publishing needs a Business or Creator account, and Facebook publishing needs a Page. If a user connects a personal Instagram account, the connect fails or posts are rejected. Checking this in your own UI before the redirect saves support tickets.