Sharing works everywhere today: the native share sheet, copy link, caption and a branded card. Posting straight to a platform is a separate, opt-in capability that only turns on with a real authorized connection.
Access tokens are stored server-side only and are never readable by the app in your browser.