Skip to main content
The X lane publishes posts to X (Twitter). It publishes only once an X credential is present in your .env; until then the lane is live-but-unauthenticated and waits for you to connect it (set PENDPOST_MODE=mock to exercise it through the mock driver). You own your X account and are responsible for X’s terms of service. pendpost drafts and schedules, but a human approves before anything goes live.

​
Choose an auth path

X supports two authentication paths. OAuth 1.0a is the recommended path for posting: it uses four long-lived keys and tokens and does not expire on a fixed schedule. OAuth 2.0 with PKCE is the alternative if you prefer a browser authorization flow. First create a Project in the X developer portal, then add an App inside it. Standalone apps cannot post; the App must live in a Project. Open the App’s “User authentication settings” and set the app permissions to Read and Write before generating any tokens, since generating tokens while the app is Read-only mints read-only tokens.

​
Setup ceremony

For OAuth 1.0a (recommended), generate both the API Key/Secret (consumer keys) and the Access Token/Secret in the portal and put them in your .env. Order matters: if you regenerate the API Key/Secret, regenerate the Access Token/Secret afterward, or the old access token is invalidated. After pasting the four values into your .env, validate the X lane in the Setup tab, or run a live probe with the health_recheck tool, to confirm the credential is live and not just configured. The lane is ready when it reports live. For OAuth 2.0 with PKCE instead, set the callback URL to http://localhost:8087/callback and run the interactive auth ceremony, which authorizes in the browser and writes the tokens to your .env:

​
Environment variables

Which group you fill depends on the path you chose. X_ACCESS_TOKEN appears in both: it is shared between the paths, so the same name holds either the OAuth 1.0a access token or the OAuth 2.0 access token, never both at once. OAuth 1.0a: OAuth 2.0 PKCE (written by the auth ceremony):
A lane publishes only once its credential is present. If the X variables are blank, the X lane is live-but-unauthenticated and waits for you to connect it. Set PENDPOST_MODE=mock to exercise it through the mock driver.

​
Validate the lane

A present credential is not the same as a working one. After setup, validate the X lane in the Setup tab, or run a live probe with the health_recheck tool, to confirm the credential is live and not just configured. The lane is ready when it reports live.
Over MCP. Setup and rotation are an interactive human ceremony; secrets are never written through MCP. An agent can still check status (account_status), run a live liveness probe (health_recheck), and read non-secret config (config_get) over MCP without touching credentials.

​
Common failures