# Social media — environment configuration

Server-side enable/disable and OAuth app credentials. Secrets never ship to the browser.

Implementation: `src/lib/social/config/social-config.ts`  
Status API (authenticated): `GET /api/social/platforms-status`

## Enable / disable flow

1. `SOCIAL_MEDIA_ENABLED` — global kill-switch (default `true` if unset).
2. `{PLATFORM}_ENABLED` — per platform (e.g. `FACEBOOK_ENABLED`).
3. OAuth **app** credentials present (`META_APP_ID` + secret, etc.).
4. User connects a project account via OAuth → **page/member tokens** stored per project.

If any step fails: Connect returns **403** with `code` + `action`; publish skips the platform with structured `errorCode` (no API call).

## Variables

| Variable | Purpose |
| -------- | ------- |
| `SOCIAL_MEDIA_ENABLED` | Global on/off |
| `FACEBOOK_ENABLED` / `INSTAGRAM_ENABLED` / `LINKEDIN_ENABLED` / `YOUTUBE_ENABLED` | Per-platform on/off |
| `TWITTER_ENABLED` / `X_ENABLED` | Keep false — X not implemented |
| `THREADS_ENABLED` / `PINTEREST_ENABLED` / `TIKTOK_ENABLED` | Default false; set true + OAuth app creds to activate |
| `PLATFORM_BLOCKED_COUNTRIES_{PLATFORM}` | Optional ISO country overrides (e.g. `PLATFORM_BLOCKED_COUNTRIES_TIKTOK=IN`) |
| `PLATFORM_ALLOWED_COUNTRIES_{PLATFORM}` | Optional allow-list (`*` = all minus blocked) |
| `META_APP_ID` / `META_APP_SECRET` | Meta OAuth app (aliases: `FACEBOOK_APP_ID`, `FACEBOOK_CLIENT_ID`, …) |
| `LINKEDIN_CLIENT_ID` / `LINKEDIN_CLIENT_SECRET` | LinkedIn OAuth app |
| `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` | YouTube OAuth app |
| Redirect URI vars | See `.env.example` |

### Not used for multi-project publish

These may appear in generic social templates; PostSync Pro ignores them for publishing:

- `FACEBOOK_ACCESS_TOKEN`, `FACEBOOK_PAGE_ID`
- `INSTAGRAM_ACCESS_TOKEN`, `INSTAGRAM_ACCOUNT_ID`
- `LINKEDIN_ACCESS_TOKEN`, `LINKEDIN_PERSON_ID`, `LINKEDIN_ORGANIZATION_ID`

Tokens and destinations come from **Connected Accounts** OAuth.

## Destination support (API facts)

| Platform | Destinations | Notes |
| -------- | ------------ | ----- |
| Facebook | **Page only** | Personal profile posting is not available via Meta Page APIs |
| Instagram | Business/Creator via Page | Same Meta app as Facebook |
| LinkedIn | **Member profile** | Org/Company Page needs `w_organization_social` — not implemented |
| YouTube | Channel | Requires FFmpeg video on the post |

## Status values (UI + API)

| Status | Meaning |
| ------ | ------- |
| `enabled` | Flag on + OAuth app creds present |
| `disabled` | Env flag false or global off |
| `missing_credentials` | Flag on but app id/secret incomplete |
| `coming_soon` / `not_implemented` | No provider code |

## Backward compatibility

- Unset `*_ENABLED` keeps LinkedIn/Facebook/Instagram/YouTube **enabled** when credentials exist (same as before).
- Existing `META_*` / `FACEBOOK_CLIENT_*` / `LINKEDIN_*` / `GOOGLE_*` names still work.