How she authenticates with each social network, and where your tokens live
Before you connect a real account you want to know what happens to the keys. This is that answer,
in the detail a security or platform review asks for.
You log in on the platform’s own screen and approve the scopes. She receives only what you approved
Publishing and analytics APIs
No headless browser, no crawling, no scraping
A credential, where OAuth does not exist
Bluesky app password, WordPress application password, Nostr key. Lemmy and Listmonk take the account’s own username and password, because that is what those instances accept
One cookie-based exception
Skool has no public API, so it uses your own browser session through the Chrome extension. Opt-in, and it carries its own terms-of-service warning
Open source and self-hostable
Run her on your own infrastructure and read every line that touches your accounts
The two are not stored the same way, and the difference matters for a review.Anything you type in is encrypted with AES-256 before it reaches the database: the credentials
above, the Skool session cookie, your organization’s API key, and the client secrets of any OAuth
app you register.Tokens the platform issues through an OAuth flow are stored as the platform returned them. For
those the database is the security boundary, so encrypt the volume and keep access to it narrow.
Believe an integration violates a platform’s terms, or found a security problem? Email
support@postqueen.ai with the details and the team will investigate.
