Verify social media account ownership in one integration

// 1) Create a delegation session (server-side)
const r = await fetch("https://postsyncer.com/api/oauth/delegate/sessions", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.POSTSYNCER_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    platform: "tiktok",
    callback_url: "https://yourapp.com/postsyncer/callback",
    state,            // random, persisted, single-use
  }),
});
const { authorize_url } = await r.json();
res.redirect(authorize_url);   // 2) send the user to authorize

// 3) verify the signed callback PostSyncer redirects back to
import crypto from "crypto";
function verify(q, secret, expectedState) {
  if (q.state !== expectedState) return false;            // CSRF
  if (Number(q.expires) < Date.now() / 1000) return false; // fresh
  const base =
    `platform=${q.platform}&platform_id=${q.platform_id}` +
    `&handle=${q.handle}&state=${q.state}&expires=${q.expires}`;
  const expected = crypto.createHmac("sha256", secret).update(base).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(q.sig), Buffer.from(expected));
}

# 1) Create a delegation session (server-side)
import requests, hmac, hashlib, time

r = requests.post(
    "https://postsyncer.com/api/oauth/delegate/sessions",
    headers={"Authorization": f"Bearer {POSTSYNCER_API_KEY}"},
    json={
        "platform": "tiktok",
        "callback_url": "https://yourapp.com/postsyncer/callback",
        "state": state,   # random, persisted, single-use
    },
)
authorize_url = r.json()["authorize_url"]   # 2) redirect the user here

# 3) verify the signed callback
def verify(q, secret, expected_state):
    if q["state"] != expected_state: return False
    if int(q["expires"]) < int(time.time()): return False
    base = (f"platform={q['platform']}&platform_id={q['platform_id']}"
            f"&handle={q['handle']}&state={q['state']}&expires={q['expires']}")
    expected = hmac.new(secret.encode(), base.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, q["sig"])

# 1) Create a delegation session (server-side)
curl -X POST https://postsyncer.com/api/oauth/delegate/sessions \
  -H "Authorization: Bearer $POSTSYNCER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "platform": "tiktok",
        "callback_url": "https://yourapp.com/postsyncer/callback",
        "state": "a1b2c3d4"
      }'

# Response → redirect the user to authorize_url
{ "authorize_url": "https://app.postsyncer.com/oauth/delegate?request=psd_…",
  "expires_in": 900 }

# 2) PostSyncer redirects back to your callback_url with:
#   ?platform=tiktok&platform_id=_000abc&handle=jane
#   &state=a1b2c3d4&expires=1717000000&sig=4d6c…e1