Whitelabel Connect

Generate branded OAuth connect pages for your end-users. Your clients connect their social accounts on a page with your logo and branding — they never see IndReelForge.

info

Whitelabel is available on Professional plan and above.

---

How it works

1. Call POST /api/whitelabel/generate-jwt with your branding config.
2. You receive an access_url valid for 48 hours.
3. Send the URL to your client.
4. Your client visits the URL, sees your branded page, and connects their social accounts.
5. Those accounts are stored under your profile — you can now post to them via the API.

---

Generate a Connect Link

POST https://api.indreelforge.com/api/whitelabel/generate-jwt
Authorization: Apikey YOUR_API_KEY
Content-Type: application/json

Request body

Field	Type	Required	Description
username	string	Yes	Profile name to connect accounts to
logo_image	string	No	URL to your logo (shown on the connect page)
connect_title	string	No	Page heading your client sees
connect_description	string	No	Subheading / instructions for your client
redirect_url	string	No	Where to send the user after connecting
redirect_button_text	string	No	Button label for the redirect (default: "Back to App")
platforms	string[]	No	Limit which platforms to show. Omit to show all.
show_calendar	boolean	No	Show a scheduling calendar on the connect page (default: false)

{
  "username": "client-brand",
  "logo_image": "https://youragency.com/logo.png",
  "connect_title": "Connect your social accounts",
  "connect_description": "Link your accounts to start publishing.",
  "redirect_url": "https://yourdashboard.com/connected",
  "redirect_button_text": "Back to Dashboard",
  "platforms": ["instagram", "youtube", "tiktok"],
  "show_calendar": false
}

Response

{
  "success": true,
  "access_url": "https://indreelforge.com/connect/abc123?jwt=eyJ...",
  "token": "abc123",
  "jwt": "eyJ...",
  "expires_in": "48h"
}

Send the access_url to your client. The JWT inside it is signed with your account secret and cannot be forged.

---

Validate a JWT

Check whether a previously issued JWT is still valid and which profile it belongs to.

POST https://api.indreelforge.com/api/whitelabel/validate-jwt
Content-Type: application/json

Pass the token either in the Authorization header or in the body:

{ "token": "eyJ..." }

Response — valid

{
  "isValid": true,
  "profile": {
    "id": "p_abc123",
    "name": "client-brand",
    "link_token": "abc123"
  },
  "redirect_url": "https://yourdashboard.com/connected",
  "platforms": ["instagram", "youtube", "tiktok"],
  "show_calendar": false,
  "expires_at": "2024-01-17T10:00:00.000Z"
}

Response — invalid / expired

{
  "isValid": false,
  "reason": "Token expired"
}

---

Get Config for a Connect Page

Fetches the branding + existing connections for a given link token. This is what the /connect/:token page calls — you generally don't need to call it directly.

GET https://api.indreelforge.com/api/whitelabel/:token

Response

{
  "pageTitle": "Connect your social accounts",
  "pageDescription": "Link your accounts to start publishing.",
  "logoUrl": "https://youragency.com/logo.png",
  "profileName": "client-brand",
  "connections": [
    {
      "platform": "instagram",
      "status": "connected",
      "platform_username": "@clientbrand",
      "profile_picture_url": "https://..."
    }
  ]
}

---

Initiate OAuth for a Platform

Starts the OAuth flow for a specific platform from a whitelabel page. The client is redirected to the platform's auth page.

POST https://api.indreelforge.com/api/whitelabel/:token/connect/:platform

Supported platforms: instagram, youtube, facebook, tiktok, x, linkedin, threads, pinterest, reddit, bluesky, google_business, discord, telegram, slack, mastodon, wordpress

Response

{
  "success": true,
  "oauth_url": "https://www.instagram.com/oauth/authorize?..."
}

Redirect or open oauth_url in the browser. After the client authorises, they are sent back to your redirect_url.

---

Disconnect a Platform

Removes a platform connection from the profile via a whitelabel link.

DELETE https://api.indreelforge.com/api/whitelabel/:token/disconnect/:platform
X-Irf-Confirm: 1

The X-Irf-Confirm: 1 header is required to prevent CSRF attacks.

Response

{ "success": true }

---

Full Integration Example

// 1. Your backend — generate a link for a new client
const res = await fetch('https://api.indreelforge.com/api/whitelabel/generate-jwt', {
  method: 'POST',
  headers: {
    'Authorization': 'Apikey YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    username: 'client-brand',
    logo_image: 'https://youragency.com/logo.png',
    connect_title: 'Connect your socials',
    redirect_url: 'https://yourdashboard.com/connected',
    platforms: ['instagram', 'youtube', 'tiktok'],
  }),
});

const { access_url, expires_in } = await res.json();

// 2. Send access_url to your client (email, in-app link, etc.)
// They visit it, connect their accounts, get redirected back to you.

// 3. Now post to their connected accounts
await fetch('https://api.indreelforge.com/api/upload/video', {
  method: 'POST',
  headers: { 'Authorization': 'Apikey YOUR_API_KEY' },
  body: formDataWithProfile('client-brand'),
});

---

Security notes

• Links expire after 48 hours. Generate a new one when needed.
• The JWT is signed with your account secret — it cannot be tampered with.
• Disconnect requests require the X-Irf-Confirm: 1 header to prevent CSRF.
• Disconnect attempts are rate-limited to 5 per 15 minutes per link token.
• Whitelabel URLs are validated against RFC 1918 / loopback ranges — private IPs are rejected.