X (Twitter)
OAuth 2.0 connect, encrypted tokens, and live text tweet publishing for scheduled posts.
X live publishing is available via OAuth 2.0 PKCE. Access and refresh tokens are encrypted at rest with INTEGRATIONS_ENCRYPTION_KEY. MVP supports text tweets only — no media upload yet.
Developer portal setup
- Create or open an app at developer.x.com.
- Under User authentication settings, enable OAuth 2.0 with a Confidential client type.
- Set the callback URL exactly to your
X_CALLBACK_URL(local default:http://localhost:3000/api/oauth/x/callback). - Request scopes:
tweet.read,tweet.write,users.read,offline.access. - Copy Client ID and Client Secret into your server environment (never commit secrets).
Environment variables
X_CLIENT_ID/X_CLIENT_SECRET— OAuth app credentialsX_CALLBACK_URL— must match the portal callback (defaults to{APP_ORIGIN}/api/oauth/x/callbackif unset)INTEGRATIONS_ENCRYPTION_KEY— same vault key used for Twilio credentials
Connect in the app
- Open Connected Accounts in your workspace.
- On the X card, choose Connect with X.
- Authorize RallyForge in the X consent screen.
- You return to the workspace with your X username shown — tokens never leave the server in plaintext.
Scheduling and Test Mode
When you schedule a post that targets X, pick the connected account (required, like a Twilio sender for SMS). The cron at /api/cron/dispatch-test-posts creates a live text tweet via API v2 when the post is due (Vercel Hobby runs once daily; Pro or an external cron is needed for minute-level timing).
Test Mode does not redirect X to email. Connected X accounts still post for real so you can verify Pay-Per-Use credits cheaply. Facebook and Instagram continue to use Test Mode preview emails.
Limitations (MVP)
- Text tweets only — media / video upload not supported yet
- Development apps are limited by X's sandbox / pay-per-use quotas
- Production apps and elevated access may be required for high volume
Related
All connection guides · Facebook & Instagram · Campaigns & scheduling