OpenPostConfiguration
Configure URLs, storage, provider apps, and optional self-hosted services.
Set OPENPOST_APP_URL, OPENPOST_PUBLIC_URL, and OPENPOST_MEDIA_URL to the addresses users and providers can reach. Use HTTPS for production. OAuth callback URLs must match the configured public URL exactly.
Storage
SQLite at OPENPOST_DATABASE_PATH and local files at OPENPOST_MEDIA_PATH are the default. Set OPENPOST_DATABASE_URL for PostgreSQL. Use an S3-compatible media configuration when media should live outside the container. Back up the database and media together.
Provider apps
Self-hosted operators create provider apps and enter their client IDs, secrets, callback URLs, and required permissions. Environment-defined provider apps are read-only in Settings and take precedence over database entries. Restart OpenPost after changing them.
| Provider | Setup requirement |
|---|---|
| X | OAuth callback registered in the X developer app |
| LinkedIn app with the required products and permissions | |
| Threads, Facebook, Instagram | Meta app with the required product, account type, and permissions |
| TikTok | App configured for the chosen posting product, review may be required |
| YouTube | Google OAuth client with YouTube API enabled |
| Mastodon | App per server, or automatic app setup on a public instance |
| Bluesky | No provider app, use an account app password |
| Discord | Incoming webhook URL |
Provider rules and app review can change. Start with one account and test one post before adding more providers.
Useful controls
Set OPENPOST_DISABLE_REGISTRATIONS=true after the first administrator has created the instance. Keep OPENPOST_JWT_SECRET and OPENPOST_ENCRYPTION_KEY private and stable. Configure CORS only for origins that need API access.