LoginSign Up
← Back to all sparks
P

Postiz

MKT AUTO
Velocity2.5

Self-hostable social media scheduling and publishing tool

postiz.com ↗

Postiz encrypts channel tokens and lets agents send connect links for new channels.

social-schedulingself-hostedmcpsecurityreliability
◆Current state
Postiz's November 13 release encrypts channels' access and refresh tokens in the database when enabled, with a local key or AWS KMS, and needs no migration. A new connect link endpoint and MCP tool let an app or agent give someone a one-hour link that adds their social channel to a workspace. It also fixes two access-control holes (billing routes open to plain members, and post saves across organizations), adds Amazon SES for email, and fixes 40+ provider and billing issues.
◆Where it's heading
Postiz still ships large releases about every six weeks. The last three have moved it from a scheduler toward publishing infrastructure that other software and agents can drive, with MCP access, preview comments and now connect links. This release adds the security work, encrypted tokens and tenant isolation, that larger self-hosted and multi-organization deployments need.
◆Prediction
The next release will likely extend connect links to platforms that need API keys or instance URLs, and keep tokens out of Temporal history, which this release describes as groundwork.

◆Recent moves

  1. 16h ago

    Encrypted channel tokens, connect links, Amazon SES & 40+ fixes

    Encrypted channel tokens, connect links for the public API and MCP, two access-control fixes and Amazon SES make this a security and reach release. It continues the move toward publishing infrastructure that agents can drive, started with the MCP connector in v2.25.

    View source ↗
  2. 1mo ago

    Preview comments, self-hosted MCP connector, responsive app & 50+ provider fixes

    v2.25 bundles collaboration (inline, threaded preview comments with anonymous commenting), reach (a self-hosted MCP connector usable from the Postiz Cloud Claude connector), and reliability (50+ provider error fixes). It extends both of Postiz's running threads at once, and carries a Prisma schema change self-hosters need to plan for.

    View source ↗
  3. 3mo ago

    Streamed media uploads, duplicate-post protection & MCP fixes

    Streaming provider uploads instead of buffering them cuts worker memory for large videos, and a pending-post workflow stops interrupted publishes from double-posting. This is the reliability groundwork that makes self-hosted Postiz viable at volume.

    View source ↗
  4. 4mo ago

    Security patch for vulnerability PSA-2026-NWZN9J

    A point release that patches security vulnerability PSA-2026-NWZN9J, with an immediate-upgrade recommendation. Self-hosters should apply it; there is no feature change.

    View source ↗