Building on AI Socials

Your creators use every feature from inside your own app, through our public API: the AI studio, posting by hand or automatically to their social accounts, results and comment replies. Everything is in the OpenAPI description and our TypeScript SDK. Nothing here needs a screen of ours, but you can use our ready-made ones.

1. Keys

Our team gives you a test key (smp_test_…) and later a live key (smp_live_…). Keep them on your server; send them as Authorization: Bearer. Creators made with a test key are sandbox creators: they connect pretend accounts and nothing reaches a real platform, so you can build the whole flow safely.

2. Creators and creator tokens

POST /v1/partner/creators signs one of your users up with your own ID for them (externalId). You must confirm they are 18 or older: we refuse anyone else. You get their organization and workspace. To act for them, your server asks for a creator token (POST /v1/partner/creators/{externalId}/tokens, 15 minutes) and calls the API with it, from your server or their browser. The creator can see and revoke your access at any time; then your tokens stop working.

3. Social accounts

Start a connection (…/connections/start) with a return address on one of your registered sites; send the creator to the address you get back. They see our page in your colours, then the platform’s own permission screen, and come back to you with connection=connected. Their tokens stay with us, encrypted, and are never sent to you or the browser.

4. Posting

Posts are drafts until approved. Each platform version is posted by hand (we remind the creator through your webhook) or automatically from a connected account. A creator can turn on auto-post (with an explicit confirmation) so posts go out without approval. We respect each platform’s limits, never post twice, and tell you what happened.

5. Webhooks

Register an https endpoint (POST /v1/partner/webhooks); you get its signing secret once. Answer with any 2xx; anything else is retried for a day. Events:

• draft.ready: A draft the AI was making is ready
• draft.failed: A draft couldn’t be made
• post.reminder_due: Time for your creator to post something by hand
• post.overdue: A post due to be posted by hand still isn’t
• post.published: A post went out (automatically, or marked as posted)
• post.failed: A post couldn’t go out (with why)
• post.metrics_updated: New results for a published post
• connection.reconnect_needed: A social account needs connecting again
• automation.sent: A comment got a private reply
• webhook.ping: A test you asked for

Check every delivery’s signature:

import { createHmac, timingSafeEqual } from 'node:crypto';

// sme-signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body">
export function verify(rawBody, header, secret) {
  const t = /t=(\d+)/.exec(header)?.[1];
  const v1 = /v1=([0-9a-f]{64})/.exec(header)?.[1];
  if (!t || !v1 || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest();
  return timingSafeEqual(expected, Buffer.from(v1, 'hex'));
}

6. Ready-made screens

Six web components you place on your pages: assistant chat, composer, draft review, calendar, post status and connected accounts. They use only the public API with a creator token, in your colours (or your own CSS variables). Your registered sites may call our API from the browser.

<script type="module">
  import { configure } from 'https://<our address>/sme-elements.js';
  configure({
    apiUrl: 'https://api.<our address>',
    organizationId, workspaceId,          // from POST /v1/partner/creators
    token: () => fetch('/me/sme-token').then((r) => r.text()), // your server, a fresh creator token
  });
</script>
<sme-composer></sme-composer>
<sme-draft-review></sme-draft-review>
<sme-calendar></sme-calendar>
<sme-connected-accounts return-url="https://your.site/social"></sme-connected-accounts>

7. Your creators’ own AI

Creators can give their own AI assistant a token for our MCP server or command line. It can write, schedule and read, but never approve: everything it writes still waits for the creator.

Sandbox walkthrough

1. With your test key, create a creator (any adult test person, 18+ confirmed).
2. Register a webhook endpoint and send yourself a webhook.ping.
3. Get a creator token and start connecting a platform; on our page press Connect: you come back connected to a pretend account.
4. Turn on auto-post for the creator (with the confirmation), write a text post for that platform with publishRoute: "api" and the account, and schedule it now.
5. Within a minute you receive post.published, signed; an hour later, post.metrics_updated with made-up results.
6. Try an automation with a pretend comment (…/test-comment) and receive automation.sent.

Questions? Ask our team. The creators’ guide