Verified safe — OAuth 2.0 PKCE

Is Rotating Posts safe?

Yes. Here's exactly why.

We use the same authorization standard as Notion, Slack, and every major enterprise app. No passwords. No guesswork. No risk of bans.

🔐

OAuth 2.0 with PKCE — what that actually means

(Proof Key for Code Exchange — the industry gold standard)

When you click "Connect X", here's the exact sequence that happens — nothing more, nothing less:

01

You're redirected to Twitter's own login page

We don't show you a form. We don't handle credentials. Twitter shows you their page at twitter.com — your browser talks directly to them.

02

Twitter asks: "Allow Rotating Posts to post for you?"

You see exactly what permissions we're requesting (post tweets). You approve or deny — directly on Twitter's UI.

03

Twitter sends us a short-lived authorization code

This code is single-use, expires in minutes, and is cryptographically bound to a challenge we generated — that's the PKCE part. Even if intercepted, it's useless.

04

We exchange the code for an access token

We never see your password. Twitter gives us a scoped access token — a key that can only do what you approved (posting). It's stored encrypted.

05

We post on your behalf using that token

Every tweet we send goes through the official X API v2. It looks exactly like a tweet you sent yourself.

Exactly what we can — and can't — do with your account.

What we CAN do
  • ✓Post tweets from your account
  • ✓Post threads you've saved in your library
  • ✓Read your public tweet history (to import)
What we CANNOT do
  • ✗See or store your password
  • ✗Read your DMs
  • ✗Follow or unfollow accounts
  • ✗Like, retweet, or reply on your behalf
  • ✗Access your email or phone number
  • ✗Delete your tweets

Our OAuth scope is limited to tweet.write and tweet.read. Nothing else is technically possible with our token.

Why your account won't get banned.

Bans happen when tools fake engagement, spam, or bypass the API. We do none of that.

🏛

Official API only

We use X API v2 exclusively. No browser automation, no screen-scraping, no grey-area tricks. Every request is logged and rate-limited by Twitter's own infrastructure.

⏳

Human-paced posting

Posts go out on a spaced schedule — never in bursts. The posting pattern is indistinguishable from a person tweeting throughout the day.

📝

Only your own content

We repost content you wrote. No mass-following, no mass-liking, no interaction farming. X's spam detection triggers on behavior patterns we never exhibit.

Revoke access in one click — from anywhere.

You can disconnect Rotating Posts at any time from two places: the Rotating Posts dashboard (Settings → Disconnect X), or directly from X Settings → Security → Connected apps. The moment you revoke, our token stops working permanently. We can't post, read, or touch your account in any way after revocation.

X Settings → Connected apps
R
Rotating Posts
tweet.write · tweet.read
Revoke

What we store — and what we don't.

✓
Your tweet content (the posts you add to your rotation library) — We need this to repost them on schedule.
✓
Your encrypted X access token — Required to post via the API on your behalf. Encrypted at rest.
✓
Posting logs (what was sent, when) — Shown in your activity feed for transparency.
✗
Your X password — We never receive it. OAuth handles auth entirely on Twitter's side.
✗
Your DMs, likes, or follower list — Outside our OAuth scope. Technically impossible with our token.
✗
Your email (from X) — We don't request the email scope. You sign up with your own email, not your X email.

The same OAuth standard that powers Slack, Notion, and every enterprise app — applied to your tweets.

Built by people who care about their own accounts too.

Security FAQ.

Does Rotating Posts store my Twitter/X password?
No. OAuth 2.0 means you log in on Twitter's own site and Twitter tells us you approved access. We never receive, see, or store your password at any point.
What is PKCE and why does it matter?
PKCE (Proof Key for Code Exchange) prevents a class of attack where someone intercepts the authorization code mid-flight and tries to use it. The code is cryptographically bound to a random secret we generate — if intercepted, it's worthless without that secret.
Has this ever caused an account suspension?
No. We post only original content at human-paced intervals using the official X API. The only behavior that triggers bans (spam, buying followers, automation outside the API) is not something we do.
What happens to my data if I delete my account?
Deleting your Rotating Posts account removes all stored tweets, settings, and your access token from our database. We retain nothing.
Can I use Rotating Posts without giving write access?
No — posting on your behalf requires write access. That's the whole product. But the scope is strictly limited to tweet posting.

Safe, automatic, and free to start.

No password shared. No card required. Cancel from X settings whenever you want.

Start Rotating — Free

Questions? Check the How It Works page or email us.