How Chirio works

A publish call does more than forward your text to four APIs. Knowing what happens in between explains most of the behaviour you will build against. A publish call creates one post with one target per account. Targets are attempted concurrently and settle independently, which is why a response can report Instagram published, LinkedIn failed, and Threads published-with-a-failed-comment all at once. Everything Chirio returns is organised that way: post carries what you sent, post.targets carries what each network did with it.

• Your key is resolved to a project. Everything the request can see — accounts, posts, usage — is scoped to it.
• The body is validated, then your accounts are checked: they must exist, belong to your project, and match the platform you named.
• Each network's own rules are applied — caption length, media counts, whether video and images can be mixed. A violation on any target rejects the whole request before anything publishes.
• Your quota is checked, still before any network call.
• The post is recorded, with its idempotency key, so a retry can never publish twice.
• Targets fan out concurrently. Each one refreshes its token if needed, uploads media, waits for the network to finish processing, publishes, posts the first comment, and records the outcome.
• Every outcome comes back to you.

A post carrying publishAt stops after step 5: the row is durable, every target is pending, and the response is a 202. A dispatcher runs every minute, claims the posts that have come due, and resumes at step 6 — the same fan-out, the same per-target outcomes, with the quota checked at dispatch time rather than at submission. Two consequences worth designing around. A target that already published is never republished, so a dispatch interrupted halfway can be safely resumed. And a platform's refusal is final: an infrastructure failure is retried, but a network that said no is recorded as failed rather than attempted again on the next tick. Each network is handled by its own adapter, which owns that platform's OAuth, media handling, publishing, comment support and token refresh. Everything above them — authentication, quota, fan-out, retries, history — is shared.