Social inboxes
Loresta supports creator-installed inbox connections through the dashboard. These connections are not exposed as public OAuth APIs for third-party developers.
X connects through OAuth 2.0 with PKCE. Loresta requests:
tweet.read users.read dm.read dm.write offline.accessThe connection subscribes to inbound DM activity when the Loresta X webhook is configured. Access tokens are refreshed server-side when possible. A failed refresh marks the connection as needing reconnection.
Instagram professional inbox access connects through Loresta’s SocialAPI flow. Capability data on the returned account determines whether Loresta may receive or reply to private messages. Loresta does not treat personal accounts or unsupported surfaces as message-capable.
Messenger
Section titled “Messenger”Messenger connects eligible Facebook Page messaging through the same controlled SocialAPI flow. Replies are limited to accounts whose returned capabilities include private messaging.
Connection states
Section titled “Connection states”| State | Meaning | Creator action |
|---|---|---|
| Not connected | No active provider account | Start the dashboard connection flow |
| Ready | Provider account is active | Review the inbox and automation controls |
| Reconnect | A previous account exists but access needs renewal | Complete provider authorization again |
| Disconnected or revoked | Loresta must no longer use the account | Connect again only when the creator chooses |
What Loresta stores
Section titled “What Loresta stores”Loresta stores the provider account identity, connection status, explicit capabilities, token expiry, and encrypted access material needed for the approved connection. Public APIs never return provider credentials.
Disconnecting removes Loresta’s active use of the account and attempts to remove the related inbox subscription where the provider supports it.
Voice learning and history
Section titled “Voice learning and history”Provider history import is optional and capability-limited. Imported provider message bodies have a bounded 30-day retention deadline. Accounts connected through a transport that does not expose history do not provide sent-message samples.
Platform boundaries
Section titled “Platform boundaries”- Threads, LinkedIn, and YouTube are not general private-inbox connections.
- TikTok DM and comment access is not available through the current Loresta connection surface.
- Google Business is oriented around approved review replies, not DMs.
- Publishing capability is separate from inbox capability and must be returned for the connected account.
These boundaries can change as providers approve different application surfaces. Implementation status is the Loresta contract, not the presence of a logo in the dashboard.