I run RecurPost, a fast growing social media scheduler and hence I know a thing or two about this.

We had to go through their approval process to be able to schedule things on your behalf. Any platform that does not ask for your username and password is legit and has been approved by Meta or Twitter etc. Some platforms ask you to install a chrome plugin to connect your account, those are not legit.