goloom

Lightweight, self-hosted social media planning for teams and AI agents.

Plan posts across Mastodon, Bluesky and Friendica from a single Go binary — no enterprise stack, no per-seat pricing.

---

goloom is a self-hosted social media planning application built as one Go binary (API + web UI). It helps teams plan posts across multiple social accounts without the heavy infrastructure and pricing model of typical enterprise-first tools.

Why goloom exists

Most tools in this space are powerful but heavy: complex stacks, many paid tiers, and product scope optimized for large organizations.

goloom was created for one focused outcome:

• plan posts across different social media accounts
• collaborate across teams
• keep operations simple
• integrate cleanly with AI agents such as OpenClaw

Screenshots

Highlights

• Single binary deployment: UI and API in one process.
• SQLite by default: no external database needed.
• PostgreSQL optional for larger deployments.
• Team workspaces with member roles (owner, editor, viewer).
• Scheduling, validation, per-account post versions, media library.
• Built-in analytics for post and account metrics.
• API-first architecture with bearer-token auth.
• OIDC support for browser sign-in.
• Mastodon onboarding can auto-register app credentials from instance URL.

Getting Started

Three ways to run goloom — pick one (full guide: Installation):

• Docker — docker run ... ghcr.io/goloom-app/goloom:latest (see Docker).
• Prebuilt binary — download a static Linux binary from the latest release (goloom_<version>_linux_amd64 / arm64), chmod +x, set ENCRYPTION_KEY + BOOTSTRAP_ADMIN_TOKEN and run it. The web UI is embedded; data goes to ./data/goloom.db (SQLite) by default.
• From source — build it yourself (below).

1) Configure environment

cp .env.example .env

Set required values:

ENCRYPTION_KEY=replace-with-a-long-random-secret
BOOTSTRAP_ADMIN_TOKEN=replace-with-a-strong-bootstrap-token

2) Build and run

make build
./bin/goloom

Open http://localhost:8080.

3) Bootstrap first admin access

Use the bootstrap token in the UI Settings screen. After first login, create normal API tokens and rotate bootstrap secrets.

API Documentation

goloom API is designed for both developers and AI agents. Professional documentation stack uses OpenAPI + Redocly.

Base paths

• Primary: /v1/...
• Alias: /api/v1/... (same handlers, for tools expecting /api/v1)

Authentication

Use bearer tokens:

Authorization: Bearer <oidc-id-token-or-api-token>

API tokens can carry scopes and an optional team binding:

• read permits authenticated GET/HEAD requests. It is independent of write and delete; add it when a client needs to fetch results or use AI-job SSE (/v1/teams/{teamID}/ai-jobs/stream?token=…).
• write includes write:draft and write:schedule; delete includes delete:draft and delete:schedule.
• An unscoped team-bound token retains owner-level management authority inside its bound team when its user is an owner. Team binding limits which team it can access; it does not make the token read-only. User roles still apply.
• Admin routes and user-wide push subscriptions require an unscoped, unbound token. Team-bound tokens cannot read /v1/users, /v1/teams, /v1/me/review-counts or /v1/me/team-notification-prefs, since those responses aggregate data across teams. Use team-specific routes where available.
• Unscoped, unbound tokens and browser sessions retain full access subject to user roles. Restricted tokens cannot be exchanged for browser sessions.

When auto-publish saves an AI result as a draft because the job lacks scheduling permission (including legacy jobs without an authority marker), the completed job exposes result.notice = "saved_as_draft_without_schedule_authority". The same non-error notice appears in the job:result SSE event. Generated result fields are preserved; failed jobs and jobs that create no post receive no notice.

API quickstart (curl)

Health and auth status:

curl -s http://localhost:8080/healthz
curl -s http://localhost:8080/v1/auth/status

List providers:

curl -s http://localhost:8080/v1/providers

Get current identity:

curl -s \
  -H "Authorization: Bearer $TOKEN" \
  http://localhost:8080/v1/me

This is the beginning of the README. Read the rest at the original. Read the full README ↗