Why connecting X matters
X is not an account login for TweetX. You sign into TweetX with Google or an email magic link. Connecting X is a separate step that grants TweetX permission to do two things for a single workspace: read your posts and metrics so the dashboard can show your real numbers, and publish posts you write.
Publishing fails closed. If no X account is connected, TweetX will not fake a post or queue a phantom draft. There is no mock publish, so this step is required before your first post goes live.
Connect your account
- 1Open Settings and find AccountsGo to Settings, then the Accounts area, and choose to connect X.
- 2Authorize on XYou are sent to X's own authorization screen. Sign in there if needed and approve the requested permissions. TweetX never sees your X password.
- 3Return to TweetXX redirects you back and the connection is stored. The workspace now shows your handle and profile photo.
- 4Let the first sync runOn the next app load TweetX pulls in your recent posts and metrics so the dashboard reflects real data.
What TweetX can and cannot do
The connection uses OAuth 2.0 with PKCE and asks for a narrow set of scopes: read your profile, read posts, write posts, and keep the connection alive when you are offline. That is the full extent of the access. TweetX cannot read your direct messages or change your account settings.
- Read your profile so it can show your handle and photo.
- Read your posts and metrics to build the dashboard.
- Write posts when you publish or schedule them.
- Refresh its own access quietly so you are not asked to reconnect every hour.
How your tokens are protected
After you authorize, X issues an access token and a refresh token. TweetX encrypts both with AES-256-GCM and stores them in a service role only table that the app front end can never read. Tokens never reach a Client Component, a URL, or a log.