# X

Connect an X account through OAuth 2.0 with PKCE.

URL: /docs/providers/x

You need an X developer application with access to the APIs used for publishing.
An installation administrator configures it before project members connect their
accounts. Provider access and usage charges are controlled by X, not Postdot;
check the current terms for your developer account.

## Configure the application [#configure-the-application]

Enable **OAuth 2.0 Authorization Code with PKCE** in the X application and allow
the intended write access. Register the callback shown by Postdot. For a public
installation it takes this form:

```text
https://postbot.example/api/oauth/x/callback
```

Replace the origin with your deployment's API origin. In Postdot's **OAuth
applications**, save the OAuth 2.0 **Client ID** and **Client secret**, activate the
application and choose its default status. Do not substitute OAuth 1.0 consumer
keys or an app-only bearer token for these fields.

The current adapter requests `tweet.read`, `tweet.write`, `users.read`,
`offline.access` and `media.write`. The developer application and authorizing
account must be eligible for the corresponding operations.

## Connect your account [#connect-your-account]

Open your X channel in **Channels**, start the connection and choose the OAuth
application if prompted. Authorize the intended account on X, then verify the
account shown back in Studio. This connection uses user authorization; it does
not publish an announcement by itself.

## If the connection fails [#if-the-connection-fails]

Check that the callback is an exact match, the credentials belong to the OAuth 2.0
configuration, and the app has the necessary access. Changing permissions may
require reconnecting to obtain a new grant. Start a new flow when authorization
is denied, expired or already consumed.

If connecting works but a post fails, inspect its delivery result and the selected
profile's text/media validation. API entitlement and media access can differ from
basic account authorization. Do not assume every failure is an expired token.

X documents [Authorization Code with PKCE](https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code).