How to do it
- Self-hosting only: create an X app In the X developer portal, create a project and an app with user authentication turned on, type Web App, and read and write permission.
- Self-hosting only: add the redirect URL Set the callback to your API origin followed by /v1/oauth/callback, the value of SOCIALHANDOFF_PUBLIC_URL plus that path.
- Self-hosting only: set the credentials Put X_CLIENT_ID and X_CLIENT_SECRET in the server environment and restart the API.
- Open Connections In the app, go to Connections and choose Add connection, then X.
- Authorize the account Sign in to X in the window that opens and approve access. You return to Connections with the account listed.
- Allow agents to use it Edit each agent key that should draft for X and tick the X network.
What X publishing supports
- Single posts checked against the weighted 280-character count, so links count as 23 and emoji as 2. Use the X character counter to see the same count.
- Threads published as reply chains.
- Up to 4 images or media per post, uploaded in chunks, each with alt text.
Retries and duplicates
X has no idempotency API. SocialHandoff retries an X publish only when X rejected it outright with a rate-limit response (429). If X returns a server error or the connection drops after the request may have gone through, the post is dead-lettered and you are asked to check the account. A missed post is easier to fix than a duplicate one.
Tokens stay on the server
The OAuth token is encrypted at rest with AES-256-GCM. Agent keys never receive it, and the accounts endpoint never returns credentials.
See the X scheduling guide for posting advice.