lancekeay.com
Writing · Tool review · 16 Oct 2026 · 4 min read

Postiz: a self-hosted social media scheduler, tested for drafts

Could a self-hosted scheduler be the posting step of a pipeline where nothing goes out without my say-so?

Lance Keay · software developer, writing from a homelab in the UK
The short version
  • The draft API and platform coverage are real: a draft was created over the API and nothing was sent.
  • It needs six containers and about 2.3 GiB of RAM to do what my pipeline needs from three or four HTTP calls.
  • Verdict: keep watching, not adopted.

What the post claims

A TikTok post presents Postiz as an AI social media scheduler: about 36,000 stars, 30-plus channels, free. Those checked out. It had about 37,300 stars, about 35 provider files in the source, and it is free to self-host (there is also a paid hosted plan, which I did not test). Licence: AGPL-3.0. Fine for internal self-hosting; if you modify it and let other people use it over a network, you must publish your changes.

My question was narrower than the post's. Should Postiz be the posting step of a video pipeline with three rules: official platform APIs only, drafts or private posts only, and nothing published without my approval?

What I ran

Postiz v2.25.1 (a 7.6 GB image) with Postgres 17 and Redis 7.2. Version 2 also needs Temporal, and Temporal needs Elasticsearch: its SQL visibility store fails with "cannot have more than 3 search attribute of type Text" and the backend never starts. So that is Temporal 1.28.1 with its own Postgres 16 and Elasticsearch 7.17.27. Six containers in all, capped at 2 CPUs, ports bound to localhost. Postiz does not retry, so it had to be restarted once Temporal was up. First start took about five minutes. Idle, it used about 2.3 GiB of RAM and about 5% of a CPU. Everything was torn down afterwards.

No real account and no real token. I inserted one fake channel row straight into the database to test drafts.

What I found

  1. Platforms. From the source: X, LinkedIn, Reddit, Instagram, Facebook Pages, Threads, YouTube, TikTok, Pinterest, Discord, Slack, Mastodon, Bluesky, Telegram, Medium, Dev.to, WordPress and more, all through each platform's own OAuth and API. You still register your own developer app on every platform.
  2. Drafts. Yes. POST /api/public/v1/posts takes type: draft|schedule|now. I created a draft (HTTP 201), it showed as "Draft" in the UI, and nothing was sent. There is no multi-user approval step, though: Teams roles exist but no approver.
  3. Platform drafts. TikTok can take an upload into its inbox as a draft, and YouTube can be set private per post. Instagram and X have no drafts at all, so Postiz's draft lives only inside Postiz and the post goes out when scheduled.
  4. The API uses a bearer key and covers upload, posts, integrations, find-slot, analytics and notifications. Tested: 200s, and 401 without a key. Webhooks fire after a post is published, so they are not an inbound queue.
  5. Token storage. From reading the source: channel tokens are stored unencrypted. Other secrets use AES-256-CBC with a key and IV derived from the JWT secret, with a static IV. The organisation API key is stored as that ciphertext, and the ciphertext is the API key: I authenticated with the value from the database. Anyone who can read the database has full API access.
  6. AI features use the OpenAI SDK with hard-coded model names. Pointing it at my own model gateway returned a 400 because the gateway has no model with that name. Not needed for posting anyway.
  7. Phone width. The UI works well: calendar, list view with drafts, the Add Channel grid.

Verdict

Keep watching. The draft API and the coverage are real. But it takes six containers, 2.3 GiB of RAM and a 7.6 GB image to do what I need from three or four HTTP calls; I would still register every platform developer app myself; the tokens sit unencrypted in its database; and Instagram and X give no real draft anyway.

Direct APIs or Postiz

  1. Direct, per platform (YouTube, Facebook Reels, TikTok upload): fewer moving parts, exact control of private and draft flags, nothing extra to secure. I write the OAuth, the token refresh and a review step.
  2. Postiz: one API for everything, OAuth, token refresh and a calendar UI for free. In exchange, a heavy stack, an extra secret store, AGPL, and a draft that is its own rather than the platform's.

I will look again once the YouTube, Meta and TikTok developer apps exist. If I then do not want to write OAuth refresh and a review calendar myself, it earns a second trial.

Draft status: one trial, nothing published, no real accounts. If you think I got something wrong, tell me and I will correct the post and say so at the top.