gitroomhq/postiz-app · error · Error

Integration not allowed

Error message

Integration not allowed

What it means

Thrown when the integration name in the OAuth callback is not in the server's allow-list of social integrations (getAllowedSocialsIntegrations). It guards the public connect endpoint from connecting unsupported or disabled providers.

Source

Thrown at apps/backend/src/api/routes/no.auth.integrations.controller.ts:55

  @Get('/')
  getIntegrations() {
    return this._integrationManager.getAllIntegrations();
  }

  @Post('/social-connect/:integration')
  @CheckPolicies([AuthorizationActions.Create, Sections.CHANNEL])
  @UseFilters(new NotEnoughScopesFilter())
  async connectSocialMedia(
    @Param('integration') integration: string,
    @Body() body: ConnectIntegrationDto
  ) {
    if (
      !this._integrationManager
        .getAllowedSocialsIntegrations()
        .includes(integration)
    ) {
      throw new Error('Integration not allowed');
    }

    const integrationProvider =
      this._integrationManager.getSocialIntegration(integration);

    const getCodeVerifier = integrationProvider.customFields
      ? 'none'
      : await ioRedis.get(`login:${body.state}`);
    if (!getCodeVerifier) {
      throw new Error('Invalid state');
    }

    const organization = await ioRedis.get(`organization:${body.state}`);
    if (!organization) {
      throw new Error('Organization not found');
    }

    const org = await this._organizationService.getOrgById(organization);

View on GitHub (pinned to 0f1647f749)

Solutions

  1. Check the exact provider slug against the backend's allowed integrations list
  2. Ensure the provider module is registered and enabled in the integration manager for this deployment
  3. Align frontend and backend versions if the provider was recently added
Defensive patterns

Strategy: validation

Validate before calling

const allowed = await fetchAllowedIntegrations();
if (!allowed.includes(slug)) throw new Error(`Provider '${slug}' not enabled on this server`);

Type guard

const isSupported = (slug: string, allowed: string[]) => allowed.includes(slug);

Try / catch

try { connect(slug); } catch (e) { if (e.message === 'Integration not allowed') showUnsupportedProvider(slug); else throw e; }

Prevention

When it happens

Trigger: GET/POST /no-auth/integrations/:integration/connect where :integration is misspelled, not compiled into the build, or disabled via configuration/feature flags.

Common situations: Deploying a custom/enterprise build where a provider was removed; typo in the integration slug; version skew between frontend expecting a provider and backend not enabling it.

Related errors


AI-assisted analysis of gitroomhq/postiz-app@0f1647f749 (2026-08-27). Data as JSON: /api/errors/df0ddd8aa6871a2a. Report an issue: GitHub.