Tumblr setup

Tumblr uses native HTTP with OAuth 1.0a signing. You register an application, finish the authorization flow yourself, and store four OAuth values plus the target blog name in the Worker.

Status and evidence

Syndroo 0.2.0-rc.1 is an unpublished release candidate: prepared in the repository, not published to npm, not tagged, and not deployed. Tumblr is recorded as experimental for this candidate.

Evidence: unit tests and the approved native-HTTP spike recorded in the core repository. The SDK route was rejected earlier because it lacked cancellation and response-size controls, so the adapter signs its own requests. There is no Mock SNS end-to-end coverage for Tumblr, and no live-account acceptance record exists. See Platform readiness and the capability record.

What you need

• A Tumblr account you can post from, and the blog you intend to publish to.
• A registered Tumblr OAuth application that gives you a consumer key and secret.
• The completed OAuth 1.0a authorization for that account, which yields the user token and token secret. Syndroo does not run this flow; you finish it once, outside the Worker.
• A running Worker and its API key. Either a deployment in your own Cloudflare account or a local instance. The Worker holds the platform credentials; clients hold only SYNDROO_API_KEY. If you have not set one up yet, the first-post walkthrough covers the whole path with Bluesky.

The adapter reads five Worker secrets:

All five are required, and the authorized user must be able to post to that blog. The blog value is validated when the Worker reads it, so a URL is rejected instead of being sent as a blog identifier.

Register the application and authorize

The Tumblr OAuth application page and its registration form are Tumblr's; keep the official documentation linked under Official sources open while you work. The documented flow is OAuth 1.0a with the HMAC-SHA1 signature method, and registering the application is what issues your consumer key.

1. Register an OAuth application

   Sign in to Tumblr, open the OAuth applications page and register an application. Registration issues the consumer key and secret for that application.

2. Complete the OAuth 1.0a authorization

   Run the OAuth 1.0a flow for the account you will publish from and approve write access for the target blog. This produces the user token and token secret. You run this step yourself, once; Syndroo only signs requests with the values you store.

3. Confirm the target blog

   Note the blog's short name, which is what the API expects, and confirm from the Tumblr client that the authorizing account can publish to it. A secondary blog the account cannot post to will fail later, after a request has been accepted.

Add the secrets to the Worker

Put the values where your runtime reads secrets: Worker secrets for a deployment, .dev.vars for a local instance. Cloudflare deployment and Local development cover the exact commands for each path.

TUMBLR_CONSUMER_KEY="your-tumblr-consumer-key"
TUMBLR_CONSUMER_SECRET="your-tumblr-consumer-secret"
TUMBLR_TOKEN="your-tumblr-user-token"
TUMBLR_TOKEN_SECRET="your-tumblr-user-token-secret"
TUMBLR_BLOG="alice"

Publish and check one post

The commands below publish for real once the secrets above are configured. Set the two client variables in the terminal that will call Syndroo.

export SYNDROO_URL="https://your-worker.your-subdomain.workers.dev"
export SYNDROO_API_KEY="the-same-secret-your-worker-has"

curl -X POST "$SYNDROO_URL/v1/posts" \
  -H "Authorization: Bearer $SYNDROO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: tumblr-setup-001" \
  --data '{
    "content": "First post from my own Syndroo Worker.",
    "platforms": ["tumblr"]
  }'

The accepted response is HTTP 202 with status queued:

{
  "id": "post_...",
  "status": "queued"
}

HTTP 202 means the request was accepted for processing. It does not confirm that Tumblr accepted anything, and it does not prove that the Queue has not already sent the platform request, because delivery can start immediately after acceptance. Read the stored state to learn the outcome:

curl \
  -H "Authorization: Bearer $SYNDROO_API_KEY" \
  "$SYNDROO_URL/v1/posts/post_..."

{
  "id": "post_...",
  "content": "First post from my own Syndroo Worker.",
  "platforms": ["tumblr"],
  "status": "published",
  "publications": [
    {
      "platform": "tumblr",
      "provider": "tumblr-native",
      "status": "published",
      "attempts": 1,
      "externalId": "700000000000000000",
      "errorAmbiguous": false
    }
  ]
}

queued and publishing are not terminal; poll the same URL. published and failed are terminal. Repeating the identical request with the same Idempotency-Key returns the stored result with HTTP 200 instead of creating a second post. See Idempotency-Key.

Limits, tokens and external dependencies

Check the provider's current documentation before relying on a specific limit, endpoint or authorization detail. Those facts change on the provider's schedule, not on this page; the links under Official sources are the references to re-check.

When something fails

A failed publication stores errorCode, errorMessage and errorAmbiguous in the post response. Read them before you act.

Official sources

• Tumblr OAuth applications
• Tumblr API documentation, including NPF publishing
• Syndroo adapter source: @syndroo/tumblr
• Capability record, taken from the product repository at commit 87ba42b and reviewed on 2026-09-18

This page follows the candidate's capability record and the product revision above. It was not verified against a live Tumblr account, so re-check the official documentation when a registration step, limit or endpoint differs from what you see.