kobak social: share posts to Mastodon and Bluesky

You write a post. It should appear on your social accounts. That used to be a solved problem, and then it wasn’t.

This plugin does the boring part: when a post is published for the first time, it posts a message to Bluesky and Mastodon, remembers the URLs it created, and lists them under the post with the u-syndication microformat.

It only runs on the transition to published. Editing an old post never re-shares it.

About replies coming back

Be clear about what this plugin does and does not do. It publishes your posts and marks up the syndicated copies. It does not receive webmentions, and it does not talk to Brid.gy.

Bringing replies back from Bluesky and Mastodon needs three separate pieces:

1. The u-syndication links, so a service can tell which social post belongs to which article. This plugin provides that.
2. A webmention receiver on your site, for example the Webmention plugin. Not included here.
3. Brid.gy, a free external service you connect to your accounts, which watches for replies and sends them to your site as webmentions. Not included here, and not affiliated with this plugin.

Without the other two, this plugin still shares your posts perfectly well. You simply will not get replies back, and the syndication box is just a list of links.

What it does

• Posts to Bluesky and Mastodon when a post is first published
• Handles the character limits (300 on Bluesky, 500 on Mastodon): the excerpt is shortened, the title and the link always survive
• Makes links in the Bluesky post clickable, using proper richtext facets
• Stores the URL of every copy it created and shows a syndication box under the post
• Can hide the local comment form without breaking webmentions, for people who collect replies on social instead
• Keeps a short log of what was sent and what came back
• Sends every request through the WordPress HTTP API, so it also works on hosts where curl_exec() is disabled

LinkedIn is optional

LinkedIn is deliberately a separate, opt-out-by-default section. Bluesky and Mastodon need nothing but an app password or a token, and take two minutes to set up. LinkedIn is a different story:

• You have to create your own LinkedIn app and request the Share on LinkedIn and Sign In with LinkedIn using OpenID Connect products
• You have to generate an access token yourself, with the w_member_social, openid and profile scopes
• That token expires after roughly 60 days and has to be generated again by hand

If that sounds like too much, leave the LinkedIn section switched off and ignore it. Everything else works without it. If you do turn it on, the post goes out as a link card with your featured image, and there are two buttons in the settings: one that checks the connection without posting anything, and one that posts a test to LinkedIn only.

What it is not

It is not a full social media scheduler. There is no queue, no analytics, no per-network message, no reposting of old content. It shares new posts, and that is all.

External services

This plugin sends data to third party services. Nothing is transmitted until you enter credentials for a service and enable sharing.

Bluesky (AT Protocol)
Used to publish your post to Bluesky. On each publish the plugin sends your handle and app password to https://bsky.social/xrpc/com.atproto.server.createSession to obtain a session, then sends the message text and your post URL to https://bsky.social/xrpc/com.atproto.repo.createRecord.
Terms of service: https://bsky.social/about/support/tos — Privacy policy: https://bsky.social/about/support/privacy-policy

Mastodon
Used to publish your post to the Mastodon instance you configure. The plugin sends your access token, the message text and your post URL to /api/v1/statuses on that instance. The instance is chosen by you, so its terms and privacy policy are those of that server. For the default suggestion, mastodon.social: https://mastodon.social/terms-of-service and https://mastodon.social/privacy-policy

LinkedIn (only if you enable it)
Used to publish your post to your LinkedIn profile. The plugin sends your access token to https://api.linkedin.com/v2/userinfo to look up your member URN, uploads your featured image to https://api.linkedin.com/rest/images, and sends the message text, post title, excerpt and URL to https://api.linkedin.com/rest/posts.
Terms of service: https://www.linkedin.com/legal/user-agreement — Privacy policy: https://www.linkedin.com/legal/privacy-policy

Credentials you enter are stored in your own WordPress database and are never sent anywhere except to the service they belong to.