API keys & authentication

Every request to the XAutoDM API is authenticated with an API key sent as a bearer token.

Getting an API key

• Sign up at the dashboard (email + password).
• Open API keys → Create live key (or test key).
• Copy the key immediately — it is shown once and never again.

We store only a SHA-256 hash of your key, so it can never be recovered from us. Lost it? Revoke it and create a new one.

Authenticating requests

Set your key as an environment variable, then pass it as a bearer token on every request:

export XAUTODM_API_KEY=xdm_live_your_key_here

curl https://api.xautodm.com/v1/account \
  -H "Authorization: Bearer $XAUTODM_API_KEY"

A missing or invalid key returns 401 invalid_key.

Live vs test keys

Live keys — xdm_live_…

Perform real calls, spend credits, and execute real writes (DMs, follows, tweets). The free plan includes 200 credits, so a live key works before you pay anything.

Test keys — xdm_test_…

Free, and they never touch X. Every endpoint returns sample data in the same shape as a live response, so you can build and test your integration before spending credits. Responses carry "dry_run": true in meta. Test keys are limited to 500 requests a day. Switch to a live key when you need real data.

Billing metadata

Each response's meta block tells you exactly what a call cost and your remaining balance:

"meta": { "credits_charged": 5, "credits_remaining": 4995, "request_id": "req_a1b2c3" }