A social media approval workflow for agencies is a repeatable way for a client to review and sign off on posts before they publish, using per-client workspaces, scoped access and scheduled publishing instead of spreadsheets. In Creator OS you get one workspace per client, a read-only API key for reviews, and scheduling from the web app, the iOS app or the CLI.
Draft in web / iOS / CLI
|
v
post_ (draft or scheduled)
|
+--> Client reviews via read-only key (sees, cannot write)
|
+--> Your team edits, approves, schedules
|
v
Posts publish on 11 platforms + Skool
|
v
Webhook: post.published / post.failed
Why spreadsheet approvals break an agency’s social media workflow
A spreadsheet is a copy of your work, so the copy and the real post drift apart the moment either one changes.
Here is what actually breaks. The client approves row 14 at 9am. Someone edits the caption in the scheduler at 10am. Row 14 no longer matches what will publish. Nobody notices until the post is live with the old copy or the wrong link. Now you are reconciling three sources: the sheet, the post record and the client’s email thread.
There is a second problem. A spreadsheet cannot tell you whether a post is a draft, scheduled, published or failed. It has no idea which platform rejected a caption for length or which TikTok post is sitting in the Creator Inbox waiting for consent flags. Your approval flow has no signal from the actual publishing system.
The fix is to approve the real post record, in the workspace it will publish from, with access scoped to that client.
What a social media approval workflow should look like in 2026
A good approval workflow makes the reviewed object and the published object the same thing, and gives each client access to only their own workspace.
Four pieces matter:
- One workspace per client. Separate sets of socials so a client can never see another client’s accounts, analytics or messages.
- Real post records. Posts live as drafts or scheduled posts with IDs like
post_, not rows in a sheet. - Scoped review access. Someone who only needs to read should hold a key that cannot write. In Creator OS, read-only connections only see read tools and the API refuses writes from them.
- Events, not polling. When a post publishes or fails, a webhook fires so your team and your client’s Slack channel both learn at the same time.
That structure is the difference between an approval “process” and an approval system. For the agency-wide version of this, see social media management for agencies.
How to set up one workspace across every client
Agency plans give you one workspace per client on the same account, with a separate API key for each.
The tiers map to client count: Agency 5 covers 5 client workspaces, Agency 10 covers 10, and each workspace holds 11 platforms plus Skool with one account on each. Agency plans include unlimited posts, comments and messages, unlimited team members, and a scoped API key per client workspace. That last part is what makes approvals clean: the key your client’s reviewer holds opens exactly one door.
| Setup step | What you do | Result |
|---|---|---|
| Create the workspace | One per client under your agency plan | Isolated socials, analytics and inbox |
| Connect accounts | 11 platforms plus Skool for that client | Posts can go out from this workspace only |
| Issue a key | Create a read-only key in Settings > API keys | Reviewer can read, writes are refused |
| Add a webhook | Subscribe to post.published and post.failed | Both sides see the outcome |
An agent holding one workspace’s key cannot post to another. That is enforced by the API, not by policy, which is what you want when a client asks “who could have posted this?”
How read-only API keys keep client approvals safe
A read-only key turns “please don’t touch anything” from an instruction into a technical limit.
Here is the worked example. Your client’s marketing lead wants to see next week’s drafts before they go live. You create a read-only key in that client’s workspace under Settings > API keys. They open the workspace in the web app or point their own AI connector at the hosted MCP server at https://mcp.creatoros.ca/mcp, sign in, pick that workspace, and choose read only. The connection gets its own key, listed under Settings > Connected apps.
From then on they can pull post lists, analytics and comments. If they try to write, the API refuses. No accidentally edited caption. No deleted post. No “sorry, wrong workspace.”
Two practical notes. Read-only connections only see read tools, so the tool list itself is shorter and less confusing for a non-technical reviewer. And destructive tools such as delete post or delete comment are marked so the AI app asks before acting, which matters when the person on the other end is a client, not your team.
Full details on connections are in the MCP docs and authentication docs.
Can clients approve posts without logging into a social media OS?
Yes. Because Creator OS runs a REST API and a hosted MCP server, a client can review inside whatever tool they already use.
Two common patterns:
- Client in their own AI app. They add the MCP URL as a connector in Claude or ChatGPT, sign in, select their workspace as read only, and ask “show me this week’s scheduled posts.” They review in plain language and reply in email or Slack with the go-ahead.
- Client in Slack. You pipe the outcome into their channel with a webhook. When a post publishes, they see it. When it fails, they see that too, with no dashboard to learn.
Either way, the reviewed object is the real post record. Approval happens against the thing that will publish. If you want the deeper version of running an agent per client, read one agent per client for agencies.
Social media upload and scheduling from web, iOS or CLI
The approval flow only works if scheduling is fast, so Creator OS lets you create the same post from three surfaces.
From the CLI, a draft goes in like this:
creatoros posts:create \
--platforms instagram,tiktok,linkedin \
--text "New drop Friday. Link in first comment." \
--media med_8f2k1 \
--scheduledAt 2026-03-14T14:00:00Z \
--timezone America/Toronto \
--draftTo check a caption before it reaches the client, run creatoros validate:post-length --text "...". To see what is waiting for approval, run creatoros posts:list --status draft. When the client says yes, move it to scheduled with creatoros posts:update <postId>.
Upload once and reuse. creatoros media:upload returns a med_ ID you can attach to the same post across every platform, which means the file your client approved is the file that publishes everywhere.
The web app and the iOS app (included on the Creator plan) run the same records, so a draft created on a phone in a meeting shows up in your CLI review queue seconds later. The command reference is in the CLI docs.
How to connect approvals with a social media API and webhooks
Approvals become automatic when your publishing system emits events your tools can act on.
Subscribe to post.published and post.failed and Creator OS signs each delivery with an X-CreatorOS-Signature header so you can verify it came from the platform. A failure at 6pm on a Friday reaches the team without anyone checking a dashboard. That is the difference between a process and a guardrail.
For teams that want more than events, the REST API is authenticated with a cos_live_ key pinned to one workspace. Create a post with a payload like this:
{
"content": "Friday drop, link in bio",
"platforms": ["instagram", "linkedin"],
"media": ["med_8f2k1"],
"schedule_at": "2026-03-14T14:00:00Z",
"draft": true
}If a channel is not connected, the API returns it in missing_platforms and the rest still go out. Errors use one shape: { error: { code, message, status } }. Webhook setup is in the webhooks docs, and the base URL lives in the Creator OS docs.
If you build this with an AI agent, the Claude Code agent guide walks through it end to end. The automation guide covers which steps should stay manual.
FAQ
What is a social media approval workflow for agencies?
It is the path a post takes from draft to published with a client sign-off in between. In Creator OS that path runs through a per-client workspace, a read-only review key, and either a scheduled post or a draft that gets promoted. The reviewed object is the same post record that publishes.
How do clients approve social media posts without a spreadsheet?
Give them read-only access to their own workspace and let them review the actual drafts and scheduled posts. They can use the web app, or connect their own AI app to the hosted MCP server and ask what is queued. Approval then lives in email, Slack or a written reply, not in a row that drifts out of sync.
Are read-only API keys safe for client social media accounts?
Read-only keys can only read, and the API refuses writes from read-only connections. Read-only connections also only see read tools, so the surface is smaller. Each key is tied to one workspace, so a reviewer for client A cannot reach client B.
Can I schedule social media uploads from the web, iOS or CLI?
Yes. The web app, the iOS app and the @creatoros/cli package all create and schedule the same post records. Upload media once with creatoros media:upload and reuse the returned med_ ID across platforms.
How is Creator OS different from Buffer for social media approvals?
Buffer is a social media scheduling dashboard. Creator OS adds a per-client workspace model with a scoped API key for each client, a hosted MCP server so an AI agent can run approvals and reviews, and a CLI for scripted publishing. It ships those on every plan, including the Creator plan at $14.99/month.
Get started with Creator OS
Set up your first client workspace, create a read-only key for their reviewer, and connect a webhook before your next round of drafts. Creator OS plans start at $14.99/month for 11 platforms plus Skool, with the API, the MCP server and the CLI included. Agency 5 is $49.99/month or $399/year for 5 client workspaces with a scoped key each.
Start free at creatoros.ca/sign-up. For walkthroughs of the CLI and the agent setup, watch the KevBuildsApps YouTube channel, and see the platform in motion in the launch video.
Get started for $0
Free trial for new subscribers. Cancel anytime.