Mastodon API

Mastodon API for posting and scheduling without managing instance-by-instance auth

A Mastodon API that handles per-instance OAuth registration, so adding an instance means connecting an account, not writing another integration.

Built for open-source communities, developer tools, and federated social products. Add Mastodon publishing with one API for scheduling, media, status, and reporting workflows.

Last updated: July 2026

One API key. No per-account fees. 15 platforms.

API key authScheduled publishing15 platforms
Quick start
API request
1await fetch("https://api.bundle.social/api/v1/post", {2  method: "POST",3  headers: {4    "x-api-key": process.env.BUNDLE_SOCIAL_API_KEY,5    "Content-Type": "application/json"6  },7  body: JSON.stringify({8    teamId: "team_123",9    title: "Mastodon update",10    postDate: "2026-05-14T10:00:00.000Z",11    status: "SCHEDULED",12    socialAccountTypes: ["MASTODON"],13    data: {14      MASTODON: {15        status: "Just shipped our API update. Here is what changed: bundle.social/changelog",16        visibility: "public"17      }18    }19  })20});
Official APIs500k+ connected accountsDirect engineer support

Building directly on Mastodon REST API

Mastodon instances each have their own rules, rate limits, and account trust requirements.
Federated publishing requires instance-aware auth and account mapping that differs from centralized networks.
Teams need Mastodon in the same scheduling workflow as Bluesky, LinkedIn, and other text-first channels.

What bundle.social handles

Schedule Mastodon posts with visibility levels, media, and alt text through one API workflow.
Publish Mastodon beside Bluesky, LinkedIn, X, and other text-first channels without a separate integration.
Keep Mastodon analytics and post history close to the rest of your social reporting.

Mastodon scheduling without instance-by-instance busywork

Federated publishing means instance rules, visibility settings, media handling, and account mapping can vary. bundle.social keeps Mastodon usable inside a broader text-first calendar.

Workflow

How it works

Connect accounts once, then create and schedule posts with channel-specific fields from one API.

01

Create an API key

Generate an organization API key in the dashboard and use it with the x-api-key header.

02

Connect accounts

Connect each social account once. bundle.social keeps the account mapping ready for future posts.

03

We talk to the user's own instance

Every Mastodon instance runs its own rules, rate limits, and character caps, so a request that succeeds on one server can fail on another. You send one request; bundle.social posts to the connected instance and reports instance-specific rejections as such.

Product architecture

Build social media workflows without rebuilding every platform

Mastodon API for federated, community-first publishing

Open-source products, developer tools, and the community teams around them use a Mastodon API for text posts, images, videos, links, alt text, polls, visibility levels, and scheduling. Mastodon is not one API but the same API implemented by thousands of independently operated servers, each with its own rules, rate limits, and account requirements.

bundle.social absorbs that federation work. Your product connects an account on whichever instance the user belongs to, then schedules posts, attaches media, and tracks status through the same workflow used for Bluesky, LinkedIn, X, and other text-first channels.

Federation means every user brings their own API host

Integrating Mastodon is unlike integrating a centralized platform in one decisive way: there is no single host, no single developer account, and no single set of limits. Each user connects from their own instance, which is operated by someone else, configured differently, rate-limited differently, and running a different version of the software. Your integration talks to as many API endpoints as you have instances.

This changes what "working" means. A request that succeeds for a user on one server can fail for a user on the next because that instance sets a lower character cap, disables a media type, runs stricter rate limits, or is simply having an outage. Correctness is per-instance, which is why bundle.social reports instance-specific rejections as instance-specific rather than as a fault in the request.

OAuth per instance is the part that surprises teams

Building Mastodon support means registering an OAuth application dynamically on each instance the first time a user connects from it, storing the resulting credentials per instance, and handling servers that block registration or go offline between connection and publish. There is no equivalent of a Meta app review to pass, but there is also no single set of credentials to manage. The operational cost moves from approval to multiplicity.

bundle.social handles the registration and credential storage per instance, so adding Mastodon to a product is a single API integration rather than an open-ended set of them.

The community has norms the API does not enforce

Mastodon users expect alt text on images, content warnings on sensitive material, and visibility chosen deliberately rather than defaulted to public. None of it is enforced by the API, and all of it affects how content is received. Automated cross-posting without those signals reads as spam to this audience in a way it does not on Instagram or X. A product that schedules Mastodon content should expose alt text and visibility as normal fields, not advanced options.

Capabilities

Mastodon API workflows for federated publishing

Instance-aware account connection, visibility fields, media, scheduling, status, and reporting context for Mastodon posts.

Mastodon-specific payload fields

Control the fields that matter on Mastodon: captions, media types, privacy settings, and more, using the same post endpoint as every other channel.

API key authentication

Use one bundle.social API key for server-to-server requests. Your users still connect social accounts once through the hosted OAuth flow; bundle.social handles token storage and refresh.

Scheduling built in

Set a postDate to schedule Mastodon content in advance, or create drafts and queue posts through the dashboard.

Media library integration

Upload Mastodon-compatible media once and reference the same upload ID across multiple posts or campaigns.

Post status and retry tracking

Track Mastodon posts through scheduled, processing, posted, retrying, and error states from the API or the shared dashboard.

Cross-platform publishing

Add other channels to the same post payload when Mastodon is part of a multi-platform campaign. No separate API calls needed.

Platform specifics

Mastodon API constraints worth knowing before you build

Mastodon is not one API. It is the same API implemented by thousands of independently operated servers with their own rules.

OAuth is registered per instance

There is no central Mastodon developer portal. An OAuth application has to be registered on each instance a user connects from, and bundle.social requests read, write, and push on that instance. This is the structural difference from every other platform we support.

The instance limit wins, not ours

bundle.social accepts up to 30,000 characters, but the connected instance enforces its own cap and it is usually far lower, typically 500 characters on default configurations. A status that passes our validation can still be rejected by the server, and the error will come from the instance.

Up to 4 media items, with 512-character alt text

A status accepts up to 4 uploads. Alt text is capped at 512 characters and content warnings, which Mastodon calls spoiler text, at 50. Alt text carries more weight in this community than on most networks.

Visibility is a first-class field

Every status carries a visibility level: public, unlisted, followers-only, or direct. It is not an afterthought setting: posting publicly where a community expects unlisted is a social error, and it cannot be changed after publishing.

Developer example

Schedule a Mastodon post

Examples use bundle.social's public API shape: API key authentication, a post date, selected social account types, and platform-specific data.

TypeScript
API request
1await fetch("https://api.bundle.social/api/v1/post", {2  method: "POST",3  headers: {4    "x-api-key": process.env.BUNDLE_SOCIAL_API_KEY,5    "Content-Type": "application/json"6  },7  body: JSON.stringify({8    teamId: "team_123",9    title: "Mastodon update",10    postDate: "2026-05-14T10:00:00.000Z",11    status: "SCHEDULED",12    socialAccountTypes: ["MASTODON"],13    data: {14      MASTODON: {15        status: "Just shipped our API update. Here is what changed: bundle.social/changelog",16        visibility: "public"17      }18    }19  })20});

Supported content

Text postsImagesVideosLinksAlt textPoll creationVisibility levels

Honest limitations

  • Mastodon instance rules, rate limits, and account eligibility still apply.
  • Federated features like cross-instance boosts and server-specific policies are outside the standard posting workflow.
  • Analytics availability depends on the connected instance and account permissions.

Guarantees

Developer-first infrastructure

Visible post status

Track scheduled, processing, posted, retrying, and error states per post.

Verbose errors

When native APIs fail, we return human-readable error messages and actionable recovery steps.

Flat pricing

No per-post counting. Predictable pricing for teams managing many users, workspaces, and connected accounts.

Same-day support

Direct access to the engineers building the API. We respond to technical issues the same day, sometimes the same hour.

Resources

Technical guides & documentation

FAQ

Questions developers ask before building

How does OAuth work without a central Mastodon developer portal?

The application is registered on each instance a user connects from, and the resulting credentials are stored per instance. bundle.social requests read, write, and push on that instance. This is the structural difference from every other platform we support, and it moves the operational cost from approval to multiplicity.

Which limits should our validation use?

The instance's, because they override ours. bundle.social accepts up to 30,000 characters while a default instance configuration is usually 500, so a status that passes local validation can still be refused by that server. Statuses accept up to 4 media items, alt text up to 512 characters, and spoiler text up to 50.

Is visibility a required field?

Every status carries one: public, unlisted, followers-only, or direct. It cannot be changed after publishing, so treat it as part of composing the post rather than as an advanced setting.

Does this replace Mastodon REST API?

No. bundle.social calls Mastodon REST API for you and absorbs the work around it: token storage and refresh, media handling, scheduling, status transitions, and turning platform errors into a cause and a next action.

Are Mastodon analytics available through the API?

Yes, for the metrics the connected account and Mastodon REST API actually expose. Availability depends on account type and granted permissions, so treat analytics as best-effort and delivery status as guaranteed.