X (OAuth 2)

Posts and the person's profile on X, over the v2 API.

Connect accounts

Each person connects their own X account in the Gateway, once, and every app that asks uses it. Apps never see the tokens. How connecting works

The redirect URI to register, with your Gateway's address (like apps.example.com):

https://<your gateway>/connect/x-oauth/callback

OAuth 2 with PKCE on X's v2 API; X's OAuth 1.0a (the v1.1 media upload) stays an app secret.

Open developer.x.com and create an OAuth app (also called a client or an integration).
Add the redirect URI above.
Copy the client ID and client secret. The secret is often shown only once.

Add it to your Gateway. It asks for the client ID and secret:

everyapp provider add x-oauth

Or add it in Manage workspace → Providers.

capabilities: {
  "x-oauth": { access: "read", scopes: ["posts.read"], why: "What the app does with it." },
},

Apps ask for these scope sets:

Set	Allows	Provider scopes
`identity`	X account (who you are)	`users.read`, `tweet.read`
`posts.read`	Posts and timelines (read)	`tweet.read`, `users.read`
`posts.write`	Posts (read and publish)	`tweet.read`, `users.read`, `tweet.write`

Check it worked: everyapp provider show x-oauth shows the client as set. Then open the account menu → Connected accounts → Connect X.

Something wrong or missing? Open an issue.