Is there a sandbox or test environment?

Not a separate one. Every call runs against a real connected X account and spends that org's credits. For safe exploration connect over OAuth with only the read scope: you get analytics, drafts, network intelligence and lead signals with no ability to publish, and the unauthenticated MCP discovery endpoint lets you read the spec and tool index before you authenticate at all.

API keys are for your own scripts and servers: one org, every scope, no user consent screen. OAuth 2.1 with PKCE is for anything acting on behalf of a user (MCP clients, hosted agents): the user signs in with X, picks scopes, and can revoke access later. Dynamic client registration is supported, so agents can onboard without a manual app setup.

What are the rate limits and what does a call cost?

AI-backed operations (compose, predict, x-ray, image generation, lead finding) are metered in credits included with the plan; the response tells you the balance and the OpenAPI document tags each operation with its scope. Plain reads are free. A 402 with code insufficient_credits or subscription_required means the org needs to top up or start a trial; the pricing page lists what is included.

Can my agent post replies or DMs automatically?

No, by design. Replies and DMs to other people are drafted by the API and queued into the owner's approval inbox; a human sends them. Publishing the owner's own posts is immediate. This keeps accounts clear of X's automation enforcement and is not configurable.

Where is the full list of endpoints?

The OpenAPI document at api.xpert.so/openapi.json is generated from the same manifest that powers the MCP tools and the CLI, so it is always complete. The MCP page groups the same surface by product area, and the MCP resource xpert://docs/tools is a markdown index of it.

Developers

One brain for X. REST, MCP, CLI.

Everything the Xpert app does is callable: 139 operations for drafting in a voice, prediction, scheduling, analytics, lead finding and engagement. One OpenAPI document, one MCP server, one CLI, one envelope.

openapi.json MCP server Get an API key

Quickstart

Four steps from zero to a scored draft. Base URL https://api.xpert.so. All responses are JSON.

01Create an API key
Sign in at app.xpert.so, open Settings → Public API keys, and create a key. It starts with sk_live_ and carries every scope for your org. Treat it like a password.
02Call the API
Every endpoint lives under /v1 and answers with one envelope: success plus your data, or success:false with a message and a machine code.
```
curl https://api.xpert.so/v1/me \
  -H "Authorization: Bearer sk_live_…"
```

03Draft in the owner's voice, then score it

Compose returns text written from the account's own posting history. Predict scores any text against that history before anyone posts it.

curl https://api.xpert.so/v1/ai/compose \
  -H "Authorization: Bearer sk_live_…" -H "content-type: application/json" \
  -d '{"kind":"post","brief":"what we shipped this week"}'

curl https://api.xpert.so/v1/ai/predict \
  -H "Authorization: Bearer sk_live_…" -H "content-type: application/json" \
  -d '{"text":"spent 3 months posting commit logs. 11 views."}'

04Act on more than one X account

An org can connect several accounts. List them, then pass x-account-id on any call; omit it for the most recently connected one.

curl https://api.xpert.so/v1/x/accounts -H "Authorization: Bearer sk_live_…"
curl https://api.xpert.so/v1/drafts -H "Authorization: Bearer sk_live_…" -H "x-account-id: <id>"

Authentication

API keys for your own automation, OAuth 2.1 with PKCE for anything acting for a user. Both hit the same endpoints and the same scope model.

API key

Created in the app. Carries every scope for the org. Send as a bearer token.

Authorization: Bearer sk_live_…

OAuth 2.1

Authorization code + PKCE, dynamic client registration, scoped consent. Metadata at /.well-known/oauth-authorization-server.

readRead & analytics
writeAuthoring & publishing
engageEngagement & automation
dmDM outreach
adminAccount admin

The envelope

{ "success": true,  "message": "Draft saved.", "id": "drf_…" }
{ "success": false, "message": "Start your free trial to use Xpert.", "code": "subscription_required" }

Codes to handle: subscription_required, insufficient_credits (402), upgrade_required (403), not_found (404). Unknown site paths return a real 404, with a markdown body if you ask for text/markdown.

MCP server for agents

Every operation is an MCP tool at https://mcp.xpert.so/mcp behind OAuth. Before authenticating, read the resources on the open discovery endpoint https://mcp.xpert.so/mcp/public: quickstart, tool index, OpenAPI, llms.txt.

Full MCP guide and tool list →

Your connector URL

https://mcp.xpert.so/mcp

One OAuth sign-in connects your X account. No API key to paste.

Pick your app

Connect Claude

1.Open Claude → Settings → Connectors.
2.Click “Add custom connector”.
3.Paste the connector URL below, then Connect.
4.Sign in with Xpert and authorize once in your browser.

Open Claude connectors

CLI

The same surface from a terminal. Pipe it, cron it, script it into a ship day. @xpertso/cli →

$ npm i -g @xpertso/cli
$ xpert login
$ xpert run network-opportunities
$ xpert run autopilot-draft --prompt "what we shipped this week"
$ xpert run find-leads --audience "founders complaining about growing on X"

Discovery files

Machine-readable entry points, all public, all cacheable. Start at the API catalog if you are a crawler, at llms.txt if you are a model.

Sandbox and safety

There is no separate sandbox: calls run against a real X account and spend real credits. To explore safely, connect over OAuth with only the read scope, or read the tool index and spec on the open MCP endpoint first. Tool annotations (readOnlyHint, destructiveHint) and the x-read-only / x-destructive flags in the OpenAPI document are accurate.

Replies and DMs to other people never send from the API. They queue into the owner's approval inbox, and a human sends them. Publishing the owner's own posts is immediate and metered. Sends are capped and spaced, and campaigns pause when X pushes back.

Questions or a key that needs rotating: contact@xpert.so.

Frequently asked questions

Is there a sandbox or test environment?: Not a separate one. Every call runs against a real connected X account and spends that org's credits. For safe exploration connect over OAuth with only the read scope: you get analytics, drafts, network intelligence and lead signals with no ability to publish, and the unauthenticated MCP discovery endpoint lets you read the spec and tool index before you authenticate at all.
API key or OAuth?: API keys are for your own scripts and servers: one org, every scope, no user consent screen. OAuth 2.1 with PKCE is for anything acting on behalf of a user (MCP clients, hosted agents): the user signs in with X, picks scopes, and can revoke access later. Dynamic client registration is supported, so agents can onboard without a manual app setup.
What are the rate limits and what does a call cost?: AI-backed operations (compose, predict, x-ray, image generation, lead finding) are metered in credits included with the plan; the response tells you the balance and the OpenAPI document tags each operation with its scope. Plain reads are free. A 402 with code insufficient_credits or subscription_required means the org needs to top up or start a trial; the pricing page lists what is included.
Can my agent post replies or DMs automatically?: No, by design. Replies and DMs to other people are drafted by the API and queued into the owner's approval inbox; a human sends them. Publishing the owner's own posts is immediate. This keeps accounts clear of X's automation enforcement and is not configurable.
Where is the full list of endpoints?: The OpenAPI document at api.xpert.so/openapi.json is generated from the same manifest that powers the MCP tools and the CLI, so it is always complete. The MCP page groups the same surface by product area, and the MCP resource xpert://docs/tools is a markdown index of it.