Partner API overview

Sign your own customers up to OnlySocial, sign them in with single sign-on, issue their API keys and connect their channels.

The Partner API is for software platforms that bring their own customers to OnlySocial. From your backend you can create a customer’s account and workspace, sign them straight into OnlySocial from your app, issue their workspace API key, and give them a link that connects their messaging channels. Nobody has to fill in a sign-up form or open the dashboard.

curl https://app.onlysocial.io/api/partner/users/dealer-4821 \
  -H "X-API-KEY: pk_xxxxxxxxxxxx"

This is a separate surface from the workspace APIs. It has its own key, and that key can act on every customer you have provisioned. A workspace API key (osk_…) works inside one workspace; a partner key (pk_…) manages your customers. They are not interchangeable.

Getting access

The Partner API is switched on per partner. Contact OnlySocial to become one. You receive:

	Looks like	Used for
Partner identifier	acme	Naming you in the single sign-on exchange
Partner API key	pk_ + 40 characters	Every /api/partner request, as X-API-KEY
SSO signing secret	64 characters	Signing the sign-in tokens for your customers

You can also ask for your customers’ e-mail addresses to be restricted to your own domains, and for your app’s address to be registered, so sign-ins can send people back to it.

Base URLs

https://app.onlysocial.io/api/partner   Partner API (provisioning, API keys, Channel Connect)
https://app.onlysocial.io/api/sso       Single sign-on exchange

What you can do

Provision customers

Create a customer’s account and their own workspace, or refresh one you created before.

Single sign-on

Send a customer from your app into OnlySocial already signed in, with no password.

Workspace API keys

Issue the osk_ key your integration uses inside a customer’s workspace.

Channel Connect

Let a customer connect WhatsApp, Facebook, Instagram, TikTok or Telegram from inside your app.

Conventions

• Your identifier, our workspace. You name each customer with your own external_id (up to 255 characters). Workspaces are addressed by their uuid, which provisioning returns.
• You only ever see your own. You may act only on a workspace that a user you provisioned administers. Anything else, including a uuid that does not exist, is a 404, never a 403, so the API cannot be used to find out about other partners’ customers.
• Envelope. Responses are { "success": true, "data": … }. Failures are { "success": false, "message": … }, plus errors on a 422 and a stable error_code where one applies.
• Rate limits. /api/partner: 60 requests a minute. /api/sso: 20 requests a minute per client address.
• JSON in, JSON out. Send Content-Type: application/json on writes.

Next

Authentication

Sending the partner key, and keeping it safe.

Endpoints

Every Partner API request, with a playground.