API keys & authentication

Every request to the XAutoDM API is authenticated with an API key sent as a bearer token.

Getting an API key

• Sign up at the dashboard (email + password).
• Open API keys → Create live key (or test key).
• Copy the key immediately — it is shown once and never again.

We store only a SHA-256 hash of your key, so it can never be recovered from us. Lost it? Revoke it and create a new one.

Authenticating requests

Set your key as an environment variable, then pass it as a bearer token on every request:

export XAUTODM_API_KEY=xdm_live_your_key_here

curl https://api.xautodm.com/v1/account \
  -H "Authorization: Bearer $XAUTODM_API_KEY"

A missing or invalid key returns 401 invalid_key.

Live vs test keys

Live keys — xdm_live_…

Perform real calls, spend credits, and execute real writes (DMs, follows, tweets).

Test keys — xdm_test_…

Run in dry-run mode: reads work normally but are not charged, and writes return a realistic mock response without touching X. Perfect for building your integration for free.

Billing metadata

Each response's meta block tells you exactly what a call cost and your remaining balance:

"meta": { "credits_charged": 5, "credits_remaining": 4995, "request_id": "req_a1b2c3" }