Connect your X account
Two ways to connect — log in with your username and password, or paste your session cookies. No OAuth approval, no API key application. This guide covers both, including exactly how to find your 2FA secret.
Two ways to connect
XAutoDM connects to your existing X account without OAuth or an API key. Pick whichever method suits you — both end up storing only an encrypted session on our server:
Log in (recommended)
Enter your X username, email, and password. Easiest for most people, and the only method that can auto-refresh your session so it doesn't expire.
Paste cookies (advanced)
Export your x.com cookies with a free browser extension and paste them in. No password leaves your browser — best if you'd rather not type your password anywhere.
Method 1 — Log in with username & password
This is the default tab in the Connect account window. Fill in your handle, email, and password — plus a 2FA secret only if your account has an authenticator app enabled.
Open Accounts → Connect account
In the app, go to Accounts in the sidebar and click Connect account. The Log in tab is selected by default.
Enter your X username
Type your handle without the @ (e.g. acmefounder). This is the account you'll send from.
Add the account's email
Strongly recommended. On a fresh login X often asks for an email as an extra identifier — adding it here makes the connection far more reliable.
Enter your password
Used once to log in. If you tick “Keep this account connected” we store it encrypted so we can refresh the session automatically; otherwise it's discarded immediately and never stored.
Add your 2FA secret (only if 2FA is on)
If your account has an authenticator-app 2FA, paste its base32 secret (see the section below). If 2FA is off, leave this blank.
Connect & validate
Click Connect. We log in on our server, store only the encrypted session tokens, and verify your handle. Then set your daily cap.
Your 2FA secret — what it is & how to get it
If your X account is protected by an authenticator app (Google Authenticator, Authy, 1Password, etc.), logging in needs a 6-digit code. Instead of typing a new code every time, XAutoDM asks for the 2FA secret once — the string your authenticator was set up with — and generates those codes for you.
JBSWY3DPEHPK3PXP (16–32 letters and digits, no spaces). It is the same seed your authenticator app uses. If your account has no 2FA, leave the field blank — you don't need any of this.If you're turning 2FA on now (easiest)
Open X security settings
On x.com go to More → Settings and privacy → Security and account access → Security → Two-factor authentication.
Choose “Authentication app”
Tick Authentication app. X will ask for your password, then show a QR code to link an authenticator.
Reveal the manual key
Under the QR code click “Can't scan the QR code?” (or “enter this key manually”). X reveals a base32 key like JBSWY3DPEHPK3PXP — that is your 2FA secret.
Copy it into both places
Paste the key into XAutoDM's 2FA secret field, and also add it to your own authenticator app (Google Authenticator, Authy, 1Password) so you keep normal access. Finish X's setup by entering a 6-digit code.
Only using text-message (SMS) 2FA? XAutoDM can't receive SMS codes, so add an Authentication app in the same X security screen and use the key it gives you. You can keep SMS on as a backup.
Paste the key into the 2FA secret field on the Log in tab. We store it encrypted and use it only to keep this account's session alive — never to change your settings or post anything.
Method 2 — Paste session cookies
Prefer not to enter your password? Export your existing x.com session and paste it in. When you're logged in to X, your browser holds three values — auth_token, ct0, and twid — that XAutoDM reads.
You'll grab them with a free browser extension called Cookie-Editor. It's a popular open tool that lets you view, edit, and export the cookies for whatever site you're on — here, x.com. Install it once and this takes about a minute.
Install the Cookie-Editor extension
It's free. Add it from the Chrome Web Store (works in Chrome, Edge, Brave, Arc) or Firefox Add-ons using the links below, then confirm “Add extension”. Optionally pin it: click the puzzle-piece icon in your toolbar and pin Cookie-Editor so it's one click away.
Open x.com and make sure you're logged in
In the same browser, go to x.com and confirm you're signed in to the exact account you want to connect. Cookie-Editor reads cookies for whichever site tab you're on, so you must be on x.com.
Open Cookie-Editor on that tab
With the x.com tab active, click the Cookie-Editor icon (a small pop-up appears listing all x.com cookies — you'll see auth_token, ct0, twid and others).
Export as JSON
At the bottom of the pop-up click the Export icon, then choose “Export as JSON”. Cookie-Editor copies the full cookie list to your clipboard — nothing else to do, no file is saved.
Paste into XAutoDM
In the app go to Accounts → Connect account → Paste cookies tab, paste the JSON, and click Connect. XAutoDM keeps only auth_token, ct0, and twid, then verifies your handle.
auth_tokenRequiredYour main session token — authenticates you with X's backend.
ct0RequiredA CSRF token X requires for write actions like sending DMs.
twidRecommendedYour numeric X user ID (e.g. u=12345678). Identifies your account.
Account safety: daily limits
X monitors DM volume — accounts that push past the safe limit get flagged. The ceiling depends on whether your account is verified. XAutoDM is optimized for inbox safety over raw volume.
Stay within the safe cap for your account type — 30/day verified, 7/day unverified.
Lower caps keep the session healthier and reduce ban risk — pushing far past the safe limit shortens how long a login lasts.
Personalized messages get far fewer spam reports than generic blasts.
Follow-up sends count toward the daily cap — factor that in.
If a session expires, log-in accounts with “keep connected” refresh themselves; cookie accounts just need a quick re-export.
Multiple accounts
Connect multiple X accounts depending on your plan (Growth = 5, Scale = 10). Each account has its own daily cap and sends from its own session — completely independent.
When you create a campaign you pick which account to send from, letting you fan out across accounts for higher volume while keeping each one safe.
Ready to connect?
Head into the app, open Accounts, and log in or paste your cookies. It takes under 2 minutes.