99.95% uptime
API SLO over the last 12 months
Docs • API v2.4.0 Enterprise
Boostly documentation & API
From first token to production in 15 minutes: OAuth 2.0, REST endpoints, HMAC-SHA256-signed webhooks and ready SDKs. Below is a live API console — switch endpoints and languages, hit “Run”.
1. Create an app
Sign up, get a client_id and client_secret. Add a redirect URI — tokens are issued only via official Meta* OAuth 2.0.
2. Get a token
Exchange the authorization code for an access token. Long-lived tokens auto-renew 7 days before expiry.
3. Find a thread and reply
Call GET /v1/threads/search, draft with POST /v1/replies/draft and publish via approve — or confirm in Telegram.
API console playground
Pick an endpoint and a language — the snippet builds itself. “Run” returns a mock response with latency.
Response
~120 ms
median REST API latency (p50)
40+ endpoints
threads, replies, ads, DMs, analytics
15 minutes
from signup to first API call
Platform capabilities
Everything for integration, out of the box
Auth, events, limits and SDKs: the four pillars integrations stand on.
OAuth 2.0 + scopes
Minimal scopes per action, PKCE for public clients, one-call token revoke via DELETE /v1/tokens.
Signed webhooks
Every event signed with HMAC-SHA256 (X-Hub-Signature-256). Retries with exponential backoff up to 24 hours.
Honest rate limits
Limits returned in X-RateLimit-* headers. Adaptive 4–9 min jitter keeps accounts clear of Meta* spam filters.
SDKs & CLI
Official SDKs for Python, Go and TypeScript + OpenAPI 3.1 spec. Generate a client for your stack in a minute.
Engineering Deep Dive
How the API works inside
Four engineering decisions that keep integrations predictable.
OAuth 2.0 authentication
Authorization Code + PKCE. Scopes: threads.read, replies.write, ads.moderate, dm.send. Tokens live in an AES-256-GCM vault; renewal is transparent.
Webhooks & HMAC-SHA256
Signatures computed over the raw body with your app secret. Verify with timing-safe compare, answer 200 within 10 seconds — or we retry.
Rate limits
600 req/min per key, 35 publishes/day per profile, 4–9 min jitter between sends. On 429 — Retry-After header and queue on our side.
SDK-first approach
OpenAPI 3.1 → generated clients. SDKs retry, refresh tokens and mask PII in logs out of the box.
Endpoint reference
Core REST API: method, path and purpose.
| Method | Path | Description |
|---|---|---|
| GET | /v1/threads/search | Semantic search of hot threads with intent scoring. |
| POST | /v1/replies/draft | Draft generation of an expert reply in your tone. |
| POST | /v1/replies/approve | Draft approval: publish or queue to Telegram. |
| GET | /v1/ads/comments | Comment stream under your ad creatives. |
| POST | /v1/ads/comments/hide | Shadow-hide spam: the author never notices. |
| POST | /v1/dm/send | Send a lead magnet to DMs with qualification. |
Webhook example: new hot thread
Boostly calls your URL on every event. Verify the signature before processing.
POST → https://your-domain/hooks/boostly • header X-Hub-Signature-256
POST /hooks/boostly HTTP/1.1
X-Hub-Signature-256: sha256=9f2c…e41a
{
"event": "thread.hot",
"thread_id": "thr_8H2KQ",
"intent_score": 0.96,
"replies_18m": 48,
"lang": "ru"
}
import hmac, hashlib
sig = hmac.new(APP_SECRET, raw_body, hashlib.sha256).hexdigest()
ok = hmac.compare_digest("sha256=" + sig, request.headers["X-Hub-Signature-256"])
Error codes
All errors are JSON with code, message and retryable fields.
| Code | Meaning | What to do |
|---|---|---|
| 400 invalid_scope | Scope outside App Review requested | Drop the extra scope, check the docs |
| 401 token_expired | Token expired | Refresh or re-run OAuth |
| 409 already_published | Reply already published | GET the status instead of retrying |
| 422 spam_suspect | Rejected as spam by Meta* | Raise jitter, slow down |
| 429 rate_limited | Limit exceeded | Honor Retry-After, enable queueing |
Boostly API vs raw Graph API vs scraping
Why integrations are built on top of us, not around us.
| Criterion | Boostly API | Direct / scraping |
|---|---|---|
| Ban risk | 0%: official quotas and jitter | High: manual limits and bans |
| Telegram approval | Built in: 1-tap approve cards | Build from scratch |
| Anti-spam moderation | Dark Post Shield included | Manual hiding only |
| Audit & compliance | Log, PII masks, SIEM export | Log it yourself |
Ship your first integration today
Sandbox, OpenAPI spec and SDKs — free in the trial. First approved reply within 15 minutes.
Ship your first integration todaySandbox included • No card required
v2.4.0Start 3 days free
API FAQ
Register an app in the dashboard: get a client_id and client_secret, complete OAuth 2.0. A test sandbox is included in the trial — sandbox keys are free.
Compute HMAC-SHA256 over the raw body with your app secret and compare against X-Hub-Signature-256 with a timing-safe compare. See the webhook section above.
600 requests/min per key, up to 35 publishes/day per profile, 4–9 min jitter between sends. Limits are visible in X-RateLimit-* headers.
Official SDKs for Python, Go and TypeScript, plus an OpenAPI 3.1 spec to generate any language. Examples live in the console tabs above.
Honor the Retry-After header and queue the job — SDKs do this automatically. Do not hammer retries: that is the fast track to a Meta* ban.
Yes: DELETE /v1/tokens/{id} revokes instantly. On login anomaly auto-revoke fires on its own and the owner gets a Telegram alert.