yeetpostyeetpost

Changelog

Three more platforms, profiles, connect URLs and scoped keys

One day of what shipped in yeetpost.

#53 #54 #55 #56 #57 #58 #60 #61 #62 #63 #64 #66 #67 #68 #69 #71 #72 #74 #75

Discord, Telegram and Mastodon are live, so six platforms now have their own docs page.

New

  • Discord: Discord channels are live: create a webhook in the channel and paste the url.
  • Discord: Posts land under the name and avatar you gave the webhook.
  • Discord: Discord takes 2000 characters and up to five images with alt text, with no threads.
  • Telegram: Telegram channels are live: make your own BotFather bot an admin of the channel and paste the token.
  • Telegram: Telegram takes 4096 characters, or 1024 when an image is attached, and png and jpeg only.
  • Telegram: Telegram supports threads and photo albums.
  • Mastodon: Mastodon is live on any instance: type the host and approve on your own server.
  • Mastodon: The character limit is your instance's own, read when you connect.
  • Mastodon: A Mastodon thread rolls back if one segment is refused.
  • Billing: Discord, Telegram and Mastodon are free to post to and count as one connected account each, like LinkedIn and Bluesky.
  • API: Every one of the six live platforms has its own docs page covering how to connect, what works and the refusal you get when it does not.
  • SDKs: A yeetpost CLI is merged, with npm publishing next, so it is not installable from a package registry yet.
  • MCP: A Claude Code plugin installs the MCP server for you, and is merged with npm publishing next.
  • SDKs: A Go SDK is hand written against the v2 API like the Node and Python ones.
  • SDKs: The Go SDK is written and merged, with publishing next, so go get does not reach it yet.
  • API: Every webhook delivery carries x-yeetpost-event-id so you can dedupe.
  • API: Webhook retries run 7 attempts on a backoff of 1m, 5m, 30m, 2h, 6h, 12h and 24h.
  • API: A webhook that exhausts its retries lands in a dead letter state instead of disappearing.
  • API: You can replay any webhook delivery from the console or the API.
  • Queue: Give a connection a set of daily slots and a timezone, and a post without a time goes into the next free slot instead of straight out.
  • API: If you post for your own customers, create a profile per customer, connect their accounts into it, and post with profileId.
  • API: A post that names a profile cannot reach anything outside it.
  • API: Connections and posts each carry their own profileId.
  • API: connection.created and connection.removed webhook events tell you when a customer's account arrives or goes.
  • Billing: Profiles do not change billing: every connection counts on the same per-account ladder and you get one invoice.
  • API: The profiles guide is at /docs/build-a-platform.
  • API: POST /profiles/{profileId}/connect returns a link to a page we host, where your customer connects their own account into that profile.
  • API: The customer lands back on your redirectUrl with the connection id in the query.
  • API: The token in a connect url is the whole authorization: one profile, one redirect, one use, fifteen minutes.
  • API: Only the hash of a connect token is stored.
  • API: headless: true drops our header and footer so the connect page sits inside your own popup.
  • API: GET /connect-sessions/{id} says how a connect went, if you would rather poll than read the query.
  • API: connection.created now carries connectSessionId so a receiver can file the connection without a browser.
  • API: A test key offers the sandbox and nothing else, so the whole connect flow runs in CI.
  • API: Pick a customer under Scope when you create a key and that key can only ever reach that one profile.
  • API: A scoped key reaches only that profile's connections, posts, media and webhooks, and anything outside is 404.
  • API: Managing profiles with a scoped key is the new 403 forbidden.
  • API: An Idempotency-Key is reserved inside the scope, so two of your customers can both send order-123 on the same day.
  • API: A key can carry a list of origins its connect URLs may redirect to.
  • API: Deleting a profile revokes the keys scoped to it in the same transaction that disconnects the accounts.
  • API: Keys are minted in the dashboard, and public key-management endpoints are next.
  • API: DELETE /posts/{postId} takes a published post down on X, Bluesky, Mastodon, Telegram, Discord and LinkedIn.
  • API: DELETE /posts/{postId} fires a post.deleted webhook.
  • API: Platforms with no delete answer delete_unsupported and say so.
  • API: POST /posts can store a draft instead of sending it.
  • API: PATCH /posts/{postId} edits a draft, and POST /posts/{postId}/publish sends it under the id you already have.
  • API: You can tag a post on the way in and filter your history by tag on the way out.
  • API: GET /health and GET /health/history are public, need no key, and report the API and every worker.
  • Console: The new status page reads the health endpoints and shows 90 days of daily uptime.
  • Console: Status days before sampling began are marked unmeasured rather than down.
  • SDKs: The Node, Python and Go SDKs and the CLI are all at parity with the v2 API: images, shapes, drafts, tags, queues and profiles.
  • SDKs: The SDKs and the CLI also cover connect sessions, health and the webhook signature check.
  • SDKs: Every SDK can create a profile, ask for a connect URL and read the session back.
  • SDKs: None of the SDKs or the CLI is published: not on npm or PyPI and not reachable by go get, so the API is still the way in.

Improvements

  • API: The OpenAPI spec got a hygiene pass, and the docs are regenerated from it.
  • API: Every error code is in the enum and in the description, and every code has a real example.
  • API: The three outcomes of DELETE /posts/{postId} are titled rather than numbered.

All changes