API keys & authentication

Every request to the XAutoDM API is authenticated with an API key sent as a bearer token.

Getting an API key

Sign up at the dashboard (email + password).
Open API keys → Create live key (or test key).
Copy the key immediately — it is shown once and never again.

We store only a SHA-256 hash of your key, so it can never be recovered from us. Lost it? Revoke it and create a new one.

Authenticating requests

Set your key as an environment variable, then pass it as a bearer token on every request:

export XAUTODM_API_KEY=xdm_live_your_key_here

curl https://api.xautodm.com/v1/account \
  -H "Authorization: Bearer $XAUTODM_API_KEY"

A missing or invalid key returns 401 invalid_key.

Live vs test keys

Live keys — `xdm_live_…`

Perform real calls, spend credits, and execute real writes (DMs, follows, tweets).

Test keys — `xdm_test_…`

Run in dry-run mode: reads work normally but are not charged, and writes return a realistic mock response without touching X. Perfect for building your integration for free.

Treat keys like passwords. Never commit them to source control or expose them in client-side code — all calls should be made from your server.

Billing metadata

Each response's meta block tells you exactly what a call cost and your remaining balance: