Editorial social publishing for WordPress
Social Media Scheduler gives teams a clean admin workspace for planning, composing, scheduling, and publishing posts across Instagram, Facebook, and TikTok.
Overview
The plugin is built for teams that plan content ahead of time and need one WordPress-native place for calendar review, account connection, OAuth settings, media attachment, external sync, and scheduled publishing.
Editorial planning
Draft, review, approve, schedule, publish, fail, or cancel posts with a status model that matches real publishing workflows.
Platform-aware publishing
Validation and publishing behavior account for Instagram, Facebook, and TikTok differences, including story support and video-only TikTok posts.
Integration ready
REST endpoints support admin nonce authentication and external API key authentication with scoped permissions.
Key Features
The plugin combines an editorial UI, OAuth account management, cron automation, REST APIs, and a layered PHP architecture.
Calendar view
Month view with status filters for drafts, scheduled posts, published posts, and failures.
Post composer
Caption, platform, account, story mode, media selection, notes, schedule time, and publish status in one screen.
Connected accounts
Meta and TikTok OAuth flows connect accounts and allow disconnecting them from WordPress admin.
Cron publishing
Due posts publish automatically, OAuth tokens refresh, and external posts sync in the background.
REST API
Endpoints cover posts, media, settings, publishing, accounts, external posts, and API keys.
Security controls
Custom capability, nonces, hashed API keys, encrypted OAuth tokens, and transient-backed OAuth state.
Admin Workflow
Social Media Scheduler adds a top-level Calendar menu and three sub-screens for day-to-day work.
| Screen | Slug | Purpose |
|---|---|---|
| Calendar | sms-calendar |
Review the month, filter posts by status, and jump to post creation. |
| New Post | sms-new-post |
Compose social content, choose account and platform, attach media, and publish now or schedule. |
| Accounts | sms-accounts |
Connect and disconnect Meta and TikTok accounts using OAuth. |
| Settings | sms-settings |
Configure editorial defaults, OAuth credentials, uninstall cleanup, and API keys. |
Requirements and Installation
Install the plugin as a normal WordPress plugin. When installing from source, install Composer dependencies before activation.
| Requirement | Version or note |
|---|---|
| WordPress | 6.4+ |
| PHP | 8.1+ |
| PHP extension | OpenSSL for OAuth token encryption |
| Permissions | Administrator or Editor after activation |
| Social apps | Meta and TikTok developer apps for live publishing |
Install from source
wp-content/plugins/social-media-scheduler
composer install --no-dev
wp plugin activate social-media-schedulerFirst-Time Setup
Open Calendar in the WordPress admin sidebar.
Go to Settings and choose timezone, default platform, and calendar week start.
Add Meta App ID and Meta App Secret for Facebook or Instagram publishing.
Add TikTok Client Key, Client Secret, and Redirect URI for TikTok publishing.
Connect the required accounts from Accounts, then create posts from New Post.
Platforms and Lifecycle
| Platform | Supported content | Notes |
|---|---|---|
| Feed posts and stories | Image posts require JPEG or PNG media. Stories require video media. | |
| Page posts and stories | Stories publish when due; future feed scheduling depends on supported Meta behavior. | |
| TikTok | Video posts | TikTok is video-only. Future posts are queued and published when due. |
Post Lifecycle
Additional recovery or terminal statuses are FAILED and CANCELLED. A future post requested as PUBLISHED is stored as SCHEDULED and published by cron when due.
OAuth Redirect URLs
| Provider | Redirect URL |
|---|---|
| Meta | https://example.com/wp-json/sms/v1/auth/meta/callback |
| TikTok | https://example.com/wp-json/sms/v1/auth/tiktok/callback |
REST API
All endpoints live under /wp-json/sms/v1. Admin requests use X-WP-Nonce plus manage_social_scheduler. External integrations can authenticate with X-API-KEY.
curl -H "X-API-KEY: your-api-key" \
https://example.com/wp-json/sms/v1/posts| Methods | Endpoint | Purpose |
|---|---|---|
GET, POST | /posts | List and create scheduled social posts. |
GET, PUT, PATCH, DELETE | /posts/{id} | Read, update, or delete a post. |
POST | /posts/{id}/media | Attach WordPress media to a post. |
POST | /posts/{id}/media/reorder | Reorder attached media. |
DELETE | /posts/{postId}/media/{mediaId} | Remove media from a post. |
GET, PUT, PATCH | /settings | Read or update plugin settings. |
POST | /media | Upload plugin-managed media. |
DELETE | /media/{id} | Delete plugin-managed media records. |
POST | /publish/meta | Publish or schedule through Meta. |
POST | /publish/tiktok | Publish or schedule a TikTok post. |
GET | /publish/{postId}/results | Read publish results for a post. |
GET, POST | /external-posts, /external-posts/refresh | List synced external posts or refresh them immediately. |
GET, DELETE | /auth/accounts, /auth/accounts/{id} | List or disconnect social accounts. |
GET | /auth/meta/callback, /auth/tiktok/callback | OAuth callback routes. |
GET, POST, PUT, PATCH, DELETE | /api-keys, /api-keys/{id} | List, create, read, update, or delete API keys. |
API Key Permissions
| Permission | Grants access to |
|---|---|
posts:read | Read posts and publish results. |
posts:write | Create and update posts and media. |
posts:delete | Delete posts. |
publish:meta | Publish through Meta endpoints. |
publish:tiktok | Publish through TikTok endpoints. |
accounts:read, accounts:write | Read or disconnect connected accounts. |
api_keys:read, api_keys:write | Read, create, update, and delete API keys. |
all | Full API access. |
Cron and Operations
Production publishing should use a real system cron job so scheduled posts are not delayed on quiet sites.
define( 'DISABLE_WP_CRON', true );
* * * * * wget -q -O - https://example.com/wp-cron.php?doing_wp_cron >/dev/null 2>&1| Event | Interval | Purpose |
|---|---|---|
sms_publish_tick | Every minute | Publish due Instagram, Facebook story, and TikTok posts. |
sms_token_refresh | Hourly | Refresh connected account tokens when needed. |
sms_external_posts_refresh | Every six hours | Sync external posts from connected platforms. |
Data Storage and Security
Custom tables and options
| Name | Purpose |
|---|---|
sms_api_key | API key records and hashed credentials. |
sms_post | Scheduled post content, platform, account, status, and timing. |
sms_post_media | Attached WordPress media and ordering. |
sms_social_account | Connected accounts with encrypted tokens. |
sms_publish_result | Platform publish status, IDs, permalinks, and errors. |
sms_external_post | Synced posts not created by this scheduler. |
sms_settings | Main settings option. |
sms_db_version | Database version state. |
sms_remove_on_uninstall | Opt-in uninstall cleanup preference. |
Security model
| Layer | Implementation |
|---|---|
| Capability | manage_social_scheduler |
| Admin REST | WordPress REST nonce plus capability check. |
| External API | X-API-KEY authentication with per-key permissions. |
| Tokens | OAuth tokens are encrypted with AES-256-CBC using a key derived from WordPress auth hashing. |
| State | OAuth state values are temporary transients. |
Development and Architecture
The plugin has no frontend build step. Admin CSS and JavaScript live directly in assets/css and assets/js, while PHP code is organized by admin, cron, domain, repository, REST, and service layers.
Useful commands
vendor/bin/phpunit -c phpunit.xml.dist
composer lint:syntax
composer lint:phpcs
wp i18n make-pot . languages/social-media-scheduler.pot --exclude=vendor,node_modulesArchitecture map
Translations are managed through POT, PO, MO, and JavaScript translation files. Generated JSON translation files should not be edited by hand.
License: Social Media Scheduler is licensed under GPL-2.0-or-later. Copyright (C) 2026 Katsarov Design.