If a social tool asks for your password, close the tab

If a social tool asks for your password, close the tab. The official way to connect an account is OAuth. You log in on the platform's own site, you grant access, they give the app a token. We store tokens. We do not store passwords.

That is not a slogan I wrote for a trust badge. Tokens expire, which is annoying, and then you reconnect. Password collection is how accounts get stolen, and it also violates most platforms' rules. I am not interested in that trade, even when it would make onboarding look smoother.

Every network still has a shape

Different networks still have different shapes, and the composer has to live with that. Bluesky uses an app password you create in their settings, which is still not your main password. Telegram needs a bot in a chat. Nostr can be a key you keep locally, or an extension that signs in the browser. None of those are "give Matt your login."

The awkward ones are still better than a shared password field. An app password you can revoke is a feature. A browser extension that will not sign from a server is a limitation I will keep explaining rather than paper over. If I cannot publish from a cron job, the UI should say so, not fail at 6am with a shrug.

When a token dies, the honest UI is: this account needs reconnecting. Not a silent fail. Not a retry loop that pretends the post went out. You will see that message. It is supposed to be slightly annoying. The alternative is a settings page full of dead logins that still have green dots.

Fewer accounts that work

I would rather have fewer connected accounts that actually work than a long list that looks impressive in a screenshot. Connect the ones you post to. Leave the rest off. A composer with three live accounts is more useful than a dashboard with twelve ghosts.

This also means I will not scrape a session cookie because an official API is slower to approve. If a platform does not have a path I can use cleanly, that platform waits. Reddit and Hacker News are listen-only in this product for related reasons. We can read what is being said. We do not fake a publish button.

You should be able to explain, in one sentence, how each connected account is allowed to post. If you cannot, do not connect it. If a vendor cannot, do not use the vendor.