I built an all-in-one Social Media Toolkit API — 8 tools in one endpoint set

#javascript #api #webdev #showdev

TL;DR: I bundled 8 commonly-needed social media utilities into a single API — username availability, hashtag generation, engagement rate, best time to post, competitor analysis, bio generation, profile validation and link shortening. It's live on RapidAPI with a free tier. Here's how I built it and how you can use it.

The problem

Every time I worked on a social-media-related side project, I needed the same small utilities:

Is this username taken on Instagram / GitHub / TikTok?
What hashtags should I suggest for this topic?
What's the engagement rate of this account?
When is the best time to post?

Each one is a tiny problem, but wiring them up separately (and legally, without scraping) is annoying. So I built Social Media Toolkit — one API that does all of it.

What's inside

Endpoint	What it does
`GET /username/check`	Username availability across 15+ platforms
`GET /hashtags/generate`	Relevant hashtags for any topic
`GET /engagement/calculate`	Engagement rate + rating
`GET /besttime`	Best posting times per platform & day
`POST /competitor/analyze`	Compare accounts with leaderboards
`GET /bio/generate`	Ready-to-use bios from keywords
`GET /profile/validate`	Detect platform & handle from a URL
`POST /shorten`	Short links with click analytics

Everything returns clean JSON and is 100% legal — no Terms-violating scraping.

Quick example

Generating hashtags is a single GET request:

curl --request GET \
  --url 'https://social-media-toolkit1.p.rapidapi.com/hashtags/generate?topic=fitness&count=10' \
  --header 'X-RapidAPI-Key: YOUR_KEY' \
  --header 'X-RapidAPI-Host: social-media-toolkit1.p.rapidapi.com'

Response:

{
  "topic": "fitness",
  "count": 10,
  "hashtags": ["#fitness", "#workout", "#gym", "#health", "#fitlife", "..."],
  "string": "#fitness #workout #gym #health #fitlife ..."
}

Or calculate engagement rate:

GET /engagement/calculate?followers=10000&likes=450&comments=30

{
  "followers": 10000,
  "engagement_rate_percent": 4.8,
  "rating": "high"
}

The tech stack (and why)

Node.js + Express — simple, well-supported, fast to ship.
Vercel (serverless) — free, no credit card, public HTTPS URL.
Upstash Redis — free, serverless, persistent storage for the link shortener (Vercel's filesystem is read-only).
RapidAPI — handles billing, keys, rate limiting and the marketplace.

One nice detail: the storage layer auto-selects its backend. Locally it uses Node's built-in node:sqlite; in production it uses Upstash Redis when the env vars are present — so the same code runs offline and in the cloud.

const useRedis =
  !!process.env.UPSTASH_REDIS_REST_URL && !!process.env.UPSTASH_REDIS_REST_TOKEN;

let backend;
if (useRedis) {
  ({ redisBackend: backend } = await import('./stores/redis.js'));
} else {
  ({ sqliteBackend: backend } = await import('./stores/sqlite.js'));
}

Securing it

Because the API runs on a public URL, I lock it to RapidAPI traffic with a proxy-secret check, so nobody can bypass billing by hitting the URL directly:

export function rapidApiAuth(req, res, next) {
  if (process.env.ENFORCE_PROXY_SECRET !== 'true') return next();
  const provided = req.header('X-RapidAPI-Proxy-Secret');
  if (provided !== process.env.RAPIDAPI_PROXY_SECRET) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  next();
}