Fondoo
GitHubStart your 7-day trial for $0Start trial
Docs

Connect your own X developer app to Fondoo

Live7 min readUpdated

X (your own app) in Fondoo: what your AI agent can do with it, what to set up first, the permissions it needs and its limits.

x_byo ("bring your own") lets Fondoo post to X using a developer app that you own. The main reason to use it is links. Fondoo's standard X connection can only post links if you approve a per-post Fondoo charge. With your own app, X bills your developer account directly, and Fondoo adds no link charge.

This is an advanced setup. You will create an X developer app and get a user access token. Read the token warning in "Before you start" first.

What Fondoo can do with it

There are two ways to use your own key.

Option A: add your key to an X account you already connected (recommended). First connect X normally (see the Connect X to Fondoo guide). Then add your token with configure_social_account.

  • Posts without links still go through Fondoo's Upload-Post connection, with images and video.
  • Posts with links go straight to X through your app. Fondoo charges nothing extra for them.
  • Link posts sent this way must be one text post. No images and no thread.

Option B: X through your own app only. Use configure_social_connection with provider x_byo. Every post goes through your app. Posts are text only: no images, video or threads. Fondoo handles the scheduling. This is also the X option for self-hosted Fondoo.

With either option, Fondoo can publish, read stats (likes, reposts, replies and similar public numbers), and delete a post it published through your app (cancel_post).

What needs your approval:

  • configure_social_account and configure_social_connection are owner-only. Run them yourself, or let an agent that holds owner permission run them. Keep the token out of chat.
  • Scheduled posts wait for your OK by default. Only the human owner can switch X to automatic publishing.

Before you start

  • An X account for your business, and the email or phone that X will use to verify it.
  • An X developer account at the X Developer Console. X's getting access guide covers signing up.
  • X API costs. New developers pay per request with prepaid credits. As of this writing, X's pricing page lists $0.015 to create a post and $0.200 to create a post that contains a URL. User lookups cost extra. Fondoo checks your token's identity before link posts and during health checks. Prices change, so check that page. You can set a spending limit and auto-recharge in the console.
  • Token lifetime warning. Fondoo needs an OAuth 2.0 user access token and sends it as Bearer <token>. X's docs say these tokens stay valid for only two hours unless you request offline.access. With offline.access, X also issues a refresh token. Fondoo stores only the access token and does not refresh it today. Expect to paste a fresh token when posts or health checks start failing. This may differ for your account.
  • The Access Token and Secret pair on X's "Keys and tokens" page is an OAuth 1.0a credential. It does not work here.

Step by step: get your credentials

  1. Create an app. Sign in at console.x.com with your business X account. Accept the developer agreement if asked. Select New App (some console versions show Create App). Give it a name and description, and describe your use, for example "Publishing my own business posts".
  2. Buy credits. Add a payment card and buy credits in the console. Set a spending limit if you want one. Without credits, X refuses API calls.
  3. Set up authentication. In your app's settings, open the user authentication section. Many consoles call it User authentication settings. Turn on OAuth 2.0 and set:
    • App permissions: Read and write. Read-only apps cannot post.
    • Type of app: Automated App / Bot or Web App. Both are confidential clients and get a Client Secret.
    • Callback URI / Redirect URL: http://localhost:8080/callback if you use X's xurl tool (next step). It must match exactly.
    • Website URL: your business website, if asked.
    See X's developer apps guide.
  4. Copy your Client ID and Client Secret from the app's Keys and tokens page. X shows secrets only once, so save them in a password manager.
  5. Get a user access token. You need the OAuth 2.0 Authorization Code flow with PKCE, signed in as the account you will post from. Request these scopes:
    • tweet.write and tweet.read, for creating and reading posts. X's Create Post reference requires both.
    • users.read, which Fondoo uses to confirm the token's account. Create Post also requires it.
    • offline.access, optional. It gives you a refresh token for your own use.
    The simplest route is X's official xurl command-line tool. Export CLIENT_ID and CLIENT_SECRET, run xurl auth oauth2, and approve in the browser. xurl saves the tokens in ~/.xurl. Copy the access token value from there. The file layout may differ by version. Developers can also follow X's authorization code guide directly.
  6. If you changed permissions after authorizing, authorize again. X says permission changes need re-authorization before new tokens carry the new access. A token you got while the app was read-only will keep failing to post.

Connect it in Fondoo

(a) From the dashboard

The dashboard's Connections page does not list x_byo. Use your agent or the API. After setup, an Option B account appears under Connected like any social account.

(b) By asking your agent

Example prompt:

I want X link posts to go through my own X developer app. Show me which X account is connected and give me the exact owner call to add my token. Don't ask me to paste the token in chat.

The agent can find your X account with list_social_accounts({ siteId }) and get setup steps with connect_service({ provider: "x_byo", siteId }). You then run the owner call yourself, so the token never enters chat.

Option A (add a key to a connected X account):

curl https://api.getfondoo.com/v1/ops/configure_social_account \
  -H "Authorization: Bearer $FONDOO_OWNER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"siteId":"<site-uuid>","accountId":"<x-account-uuid>","xByo":{"accessToken":"<token>"}}'

Fondoo looks up the token's X account and refuses it if it is not the same account as accountId. To remove your key later, send "xByo": null.

Option B (own app only):

configure_social_connection({ siteId, provider: "x_byo", credential: { accessToken: "<token>" } })   // returns connectionId
refresh_social_accounts({ siteId, connectionId })

Before posting, X must be in your distribution rules with a daily cap. The human owner sets this with update_distribution_rules, for example { "network": "x", "formats": ["text"], "dailyCap": 5 }. The update replaces all rules, so keep your other networks in the list.

Test that it works

  1. Run list_social_accounts({ siteId }). With Option A, your X account shows xByoConnected: true.
  2. Run get_connection_health({ siteId }). Look for a social:x_byo:... entry. It fails with "X identity mismatch" or a provider error if the token is wrong or expired.
  3. Preview a link post with schedule_social_posts and "dryRun": true. With Option A, the x_link check should show billing: "customer_x_account".
  4. Schedule it for real, approve it on Home, and check the post on X.

Troubleshooting

  • "X BYO token belongs to a different account" The token was issued while you were signed in to a different X account. Sign in to X as the business account and get a new token. If you are sure it is the same account and this still appears, contact Fondoo support. The way Upload-Post identifies X accounts may not match X's own user ID for every account.
  • Posting fails with a 401 or 403 provider error. The token has probably expired (after about two hours), been revoked, or lacks tweet.write. It may also come from a read-only app. Get a new token after checking step 3.
  • Provider error 429, or posts stop after working before. You may have hit an X rate limit, run out of credits, or reached your spending limit. Check usage in the X console.
  • "The minimal X BYO client supports text and links only; supply a single text post" Remove images and thread parts from link posts.
  • "Configure your own X OAuth2 user access token with configure_social_connection first" The Option B connection has no token yet. Run configure_social_connection again with the token.
  • Dashboard still shows the $0.50 checkbox. The dashboard composer may show it even after you add your key. With your key on the account, the server sends link posts through your app and does not charge. This may differ for your account. Agents and the API are not affected.

Limits, data and security

  • 280 characters per post. Text only for link posts (Option A) and for every post (Option B).
  • X rate limits and per-request prices apply to your developer account. See X pricing.
  • Fondoo encrypts the token and stores it on the server. It is never returned by any operation. list_social_accounts shows only xByoConnected: true.
  • To rotate: get a new token and run the same call again. To disconnect: send "xByo": null (Option A), revoke the app under X's connected apps, or regenerate the Client Secret in the X console.