How it works
What actually happens when you press Publish
FrameFlow is a pipeline with six stages. None of them happen behind your back: material is produced, reviewed, queued, and delivered in that order, and every step leaves a record you can read afterwards.
The sequence
- 1
Connect the accounts you own
Each destination is configured once in Connections. TikTok runs an authorization-code flow with PKCE in the browser; YouTube and X take credentials you mint in their own developer consoles. Every token is encrypted before it is stored, and a Validate button proves the connection works before you depend on it.
- TikTok authorization requests only user.info.basic, video.upload, and video.publish
- Access can be revoked from the platform's own settings at any time
- A rejected token is quarantined until the account is reconnected, rather than retried in a loop
- 2
Produce the material
Write a prompt and generate a clip or image, optionally anchored to a source image, or upload a file you already have. Video generation is asynchronous: the request id is stored and polled with a bounded window, so a slow job neither blocks the interface nor runs forever.
- Generated and uploaded media both land in the same library
- An extracted last frame can seed the next clip, keeping a sequence continuous
- Rejected files fail before any database row is written
- 3
Compose and watch it back
Stitch clips together locally with ffmpeg, then play the result in the browser. Titles and captions are written alongside the preview, with each destination's character limit enforced in the form rather than discovered when the platform refuses the post.
- Range-enabled playback, so scrubbing works on long files
- Per-destination limits shown while typing
- Nothing has left the server at this point
- 4
Queue the publish
Pressing Publish writes one row per destination and returns immediately — the upload itself is claimed by a background worker. The row records the exact settings chosen at queue time, so a retry or a scheduled run reproduces what the form said rather than what the form says now.
- Rows move through queued or scheduled → publishing → published or failed
- The claim is a single atomic statement, so overlapping ticks cannot take the same row twice
- A 300 MB video to two platforms cannot time out the HTTP request
- 5
Deliver through the platform's own handshake
Each destination is driven exactly as its documentation prescribes. For TikTok that means querying creator info first, initializing the upload, sending the file in chunks with a content range, and polling status until the post completes — or reaches your drafts, if that is the mode you chose.
- Creator settings are read before the post, so a privacy level your account does not offer fails preflight instead of being sent
- AI-generated content is labelled on every direct post
- The publish status is polled until the platform confirms it, and the outcome is stored
- 6
Keep the record
Every attempt stays in the Activity view with its status and any error the platform returned. Failed or cancelled rows can be retried by hand; retries are never automatic, because a silent second attempt can double-post or burn a paid quota.
- Errors are surfaced verbatim rather than flattened into 'something went wrong'
- Deleting a record does not delete the post on the platform
- History survives redeployment — data lives outside the release directory
Boundaries
What FrameFlow will not do
A publishing tool sits close enough to someone's audience that the limits matter as much as the features.
- Post to an account that has not completed that platform's own authorization flow.
- Publish anything without an explicit press of the Publish button.
- Scrape cookies, automate passwords, or call unofficial endpoints.
- Retry a failed post automatically, where that could double-post.
- Return a stored credential to the browser, or write one to client storage.
- Post AI-generated video without the disclosure the platform requires.
The full detail is in the policies
What is collected, where it is stored, how long it is kept, and how to have it removed — written out in the Privacy Policy, with the operating rules in the Terms. Questions to zhangyang8605@gmail.com.