Social Posts Sync Proxy
Meta OAuth proxy for the WordPress plugin Social Posts Sync. Authenticates your WordPress sites with the Facebook & Instagram API without exposing your Meta credentials.
API Reference
GET
/licence/validate
Checks whether a licence key is valid for a given domain. Automatically called by the WordPress plugin on activation. Accepts GET and POST.
Parameters
licence_key
required
UUID of the licence provided by the proxy administrator.
domain
required
Domain name of the WordPress site (e.g. example.com).
Responses
{"ok": true} — Valid licence for this domain.
{"ok": false, "error": "..."} — Possible errors: license_invalid, license_expired, domain_not_allowed.
POST
/licence/revoke
Removes a domain from a licence's list of allowed domains. Automatically called by the WordPress plugin on deactivation, or manually via the public form. Accepts GET and POST.
Parameters
licence_key
required
UUID of the licence associated with the domain.
domain
required
Domain name to remove (e.g. example.com).
Responses
{"success": true} — Domain revoked.
{"success": false, "error": "license_invalid"}
{"success": false, "error": "domain_not_found"} — The domain is not registered on this licence.
GET
/auth/facebook
Entry point for the Meta OAuth flow. Validates the licence, stores the return URL in session, then redirects the user to facebook.com/dialog/oauth for authorization. The domain from the back parameter must be registered in the licence.
Parameters
back
required
Full URL to redirect to after OAuth (your WordPress site URL).
licence_key
optional
If provided, used to validate the licence. Otherwise, the domain is looked up across all active licences.
Meta permissions requested
Responses
POST
/auth/facebook/refresh
Refreshes an existing long Meta token to get a new one valid for ~60 days. Called by the WordPress plugin before the stored token expires. The licence key serves as a per-site authentication secret.
Headers
X-Licence-Key
required
UUID of the licence associated with the domain.
Body application/x-www-form-urlencoded
access_token
required
Current Meta token to refresh.
back
required
WordPress site URL — used to validate the licence domain.
Responses
{"facebook_access_token": "...", "expires_in": 5183944}