Building X automation: API access, budgets and test accounts
Separate the platform account, developer application and API budget before building a bot. A mailbox or X login does not establish developer access, a working token or permission to automate a particular action. This checklist is for planning and testing an integration, not a promise that a purchased account will unlock it.
Check the current API model, not an old tier table
As checked on October 18, 2026, X’s pricing documentation describes usage-based credits and endpoint-specific charges. The previous Free/Basic/Pro monthly-price table has been removed from this guide. Review the current console rates for your endpoints before committing to a project.
Budget for development retries, production traffic and your own infrastructure separately. Configure a spending limit and monitor consumption. A billing allowance and an endpoint’s rate limit are different constraints; more budget is not proof that a burst of requests is permitted.
Write an endpoint and permission inventory
| Record | Question to answer before development |
|---|---|
| Action | Is the workflow reading data, publishing approved content or handling messages? |
| Access | Which documented endpoint and authentication context does it require? |
| Owner approval | Who controls the account and approves each type of action? |
| Cost and limits | What volume is expected, and how will the app respond to an exhausted budget or limit? |
| Revocation | How does the operator stop the worker and remove access? |
Build tests before connecting a real account
Use fixtures for successful responses, expired credentials, denied permissions, timeouts and rate-limited responses. A useful test suite proves that a failed operation is not silently marked successful and that a retry does not create an unintended duplicate post.
- Start with a dry-run queue that records intended actions without publishing them.
- Use an account you control for a minimal, explicitly approved integration check.
- Verify the resulting platform state before marking the job complete.
- Test a restart, a revoked grant and a disabled job. Keep an operator stop control.
- Store secrets outside source control and redact tokens and message contents from logs.
Review the automation rules for the actual behavior
X’s automation rules prohibit automated likes and duplicative multi-account activity. Other actions have their own restrictions and consent requirements. Read the rule for the proposed action rather than treating API availability as permission.
What account packages do and do not supply
The X package listings describe included credentials; product cards show current origin quotes. Email verification is not developer approval, a developer subscription, an audience or an engagement guarantee. Account age does not change those distinctions.
If the API requirement is essential, establish it independently before choosing a package. For the broader design, read account and permission requirements for AI agents. For client projects, use the approval and measurement checklist.