Skip to content
Automagic SocialAutomagic SocialAutomagic Social

X

X posts use the official create post endpoint. Sign-in is OAuth 2.0 Authorization Code with PKCE. The product does not scrape x.com.

What you can send

Section titled “What you can send”
Kind Availability
Post Text, up to 4 images, 1 GIF, or 1 video
Thread A chain of posts
Reply On pay-per-use, only when the original author mentioned this account or quoted it
Quote Enterprise only. Pay-per-use apps cannot quote.

Text is 280 weighted characters. Most characters count as 1, emoji and CJK count as 2, and each link counts as 23. The draft title is not posted. The post text is the caption, plus hashtags and the link.

Media Cap
Image (JPEG, PNG, or WebP) 4 images, 5 MB each
GIF 1 file, 15 MB
Video, account that is not X Premium 1 file, up to 20 minutes and 8 GB
Video, account marked X Premium 1 file, up to 125 minutes and 16 GB. X checks again when the post is created.

Media uses chunked upload: initialize, append, finalize, and status.

Published app limits this product follows are 10,000 posts per app per 24 hours and 100 posts per user per 15 minutes. Check Rate limits if X has changed those numbers.

Credits

Section titled “Credits”

The X API is pay-per-use. You buy credits in the console and set a spending limit. There is no subscription on that plan. Prices and the balance are on Pricing. A post that contains a link costs more than a post without one. Pay-per-use posts can include at most one cashtag.

Set X_API_ACCESS_LEVEL before posting:

Value Meaning
pay_per_use Credits are in place. Posting is on, with the pay-per-use rules above.
enterprise This app is actually on an Enterprise plan. Quotes are allowed, and the pay-per-use reply and cashtag limits are not applied.
out_of_credits The balance is empty or the spending limit is hit. Posting and lookup stay off.

Connect can succeed before this is set. Posting stays off until the level is pay_per_use or enterprise.

Set up the X app

Section titled “Set up the X app”
  1. Sign in at the developer console and accept the Developer Agreement. Getting access walks through the app.
  2. The app name and website are shown as the source on posts, so use the real product name and site.
  3. Turn on OAuth 2.0. Choose Web App (a confidential client). Set X_OAUTH_CLIENT_TYPE=confidential. The product sends PKCE (S256) as well.
  4. Set the callback URL to the redirect URI from Accounts, character for character.
  5. Request tweet.read, tweet.write, users.read, media.write, and offline.access. offline.access is what makes X return a refresh token. The access token itself is short-lived. Give the app Read and write permission. media.write is required for images and video. Text can post without it.
  6. Copy the client id and secret once into X_CLIENT_ID and X_CLIENT_SECRET. They are shown once.
  7. Set X_HTTP_ALLOW_NETWORK=1 only on the server that is allowed to call api.x.com. Connect stays disabled everywhere else, including a laptop and CI.

The product does not read mentions or other inbound activity. If a publish comes back uncertain, look it up. The product will not send it again.