BYOK (Bring Your Own Keys)

What BYOK means

With Bring Your Own Keys, you create a developer application on each social platform and give Dravo its OAuth client_id and client_secret. People see your platform app on the consent screen, tokens inherit your platform app's permissions, and all calls use its access tier and rate limits.

An OAuth app in Dravo is a configuration record, not a new application created on the social platform. Configure the real platform app first, then save its credentials in Dravo and connect one or more accounts through it.

What Dravo manages

• Builds the authorize URL with the exact scopes required by its adapter.
• Signs and verifies OAuth state; X also uses PKCE.
• Receives the platform callback and exchanges the authorization code.
• Resolves the social identity and creates the Dravo account record.
• Encrypts access tokens, refresh tokens and platform secrets.
• Refreshes tokens when the platform issued renewable credentials, and marks the account for reconnection when it cannot be refreshed.
• Normalizes platform-specific publishing and errors behind the Dravo API.

What you manage

• Developer-account enrollment and any platform billing.
• Platform app creation, ownership and verified business details.
• Products, use cases and permissions enabled on that app.
• Exact registration of the Dravo redirect_uri.
• Test users, app roles, Page access and eligible account types.
• App Review, Advanced Access, partner approval or TikTok audit.
• Platform policies, privacy policy, terms URL, data deletion and compliance.
• The impact of changing or deleting the platform app or rotating its secret.

The full configuration sequence and callback table are in Configure OAuth and connect accounts.

How credentials are stored

OAuth client secrets and per-account tokens are encrypted at rest with AES-256-GCM and bound to your Dravo user identity as associated data. They are decrypted only when an OAuth or platform operation needs them. Dravo never returns a stored client secret through the API.

Keep the platform secret server-side. A Dravo API key may create an OAuth app, but your frontend should call your own backend rather than embedding either secret in browser code.

Development versus production

Platform development modes are deliberately restricted. An app admin or tester may be able to authorize and publish before review, but that does not prove that unrelated customer accounts can connect in production.

Typical production gates include:

Always validate with a platform test user first, then with a non-role account after approval. See each platform guide for the exact products, scopes and review path.