# Connect your app or agent to SocialCannon
Public setup instructions, not an MCP endpoint. Choose REST for server-side applications and pipelines, or stdio MCP for a compatible agent host.

## 1. Human account
Create a free account at https://socialcannon.app/sign-in using Google or GitHub. No card is required.
Credentials are at https://socialcannon.app/dashboard/settings?tab=api-keys . The Client Secret is shown once. If it is missing, explain that generating a replacement invalidates the old secret; obtain permission before rotating it.
Have the human supply SOCIALCANNON_CLIENT_ID and SOCIALCANNON_CLIENT_SECRET privately through the environment or the host's secret configuration. Never ask for secrets in chat, URLs, source control or logs. Preserve existing configuration and permissions.

## 2. REST
Use Node.js 18+ on the server, with credentials supplied privately through the environment. Run this only when the human agrees to a sandbox test:

// Node.js 18+. Save as socialcannon-test.mjs and run on your server.
// Supply SOCIALCANNON_CLIENT_ID and SOCIALCANNON_CLIENT_SECRET
// through your environment or secret manager. Never embed them in browser code.
const base = 'https://socialcannon.app';
const clientId = process.env.SOCIALCANNON_CLIENT_ID;
const clientSecret = process.env.SOCIALCANNON_CLIENT_SECRET;
if (!clientId || !clientSecret) throw new Error('Set your credentials first.');

const auth = await fetch(base + '/api/v1/auth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    grant_type: 'client_credentials',
    client_id: clientId,
    client_secret: clientSecret,
  }),
});
if (!auth.ok) throw new Error('Authentication failed: ' + auth.status);
const token = await auth.json();
if (!token.success || !token.data?.access_token) {
  throw new Error('No access token returned.');
}

const response = await fetch(base + '/api/v1/posts', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer ' + token.data.access_token,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    accountId: 'sandbox',
    content: 'Hello from my own workflow!',
  }),
});
if (!response.ok) throw new Error('Sandbox test failed: ' + response.status);
const result = await response.json();
if (!result.success) throw new Error('Sandbox test was not confirmed.');
console.log(result); // Simulated post. Nothing goes to a real social account.

Access tokens expire; request another token when needed. See https://socialcannon.app/docs for scopes, rate limits, scheduling and error handling. For real posts, verify account ownership and the destination's media requirements first; do not blindly retry uncertain publish responses.

## 3. MCP alternative
Use command "npx", args ["-y", "@socialcannon/mcp@1.0.2"]. Supply SOCIALCANNON_CLIENT_ID and SOCIALCANNON_CLIENT_SECRET privately to the server process through your host's environment or secret settings. The JSON below is the common mcpServers format; adapt it to your host. Some hosts filter inherited variables, so configure their secret mapping explicitly. Never paste credentials into chat.

{
  "mcpServers": {
    "socialcannon": {
      "command": "npx",
      "args": [
        "-y",
        "@socialcannon/mcp@1.0.2"
      ]
    }
  }
}

Discover the MCP tools, then call list_accounts to verify authenticated access. Tool discovery alone is not proof of a working account connection.
With the human's agreement, call create_post with accountId="sandbox" and content="My first SocialCannon sandbox post". Do not set scheduledAt. This simulates publishing; report it as a sandbox test only after the tool confirms success. Stop and explain errors without exposing credentials.
For a real destination, have the human authorize their social account at https://socialcannon.app/dashboard/accounts . Call list_accounts again and verify the intended destination exists.
Connecting does not authorize posting. Prepare drafts with the human; obtain explicit approval before real publishing, scheduling, replies, retries, deletion, disconnection or credential changes. create_post without scheduledAt publishes immediately; it does not save a draft.
Platform capabilities: https://socialcannon.app/api/v1/platforms . Media requirements, quotas and feature availability vary by platform and plan: https://socialcannon.app/pricing . SocialCannon does not read or reply to private social DMs.
Support: support@socialcannon.app