docs

Quickstart — your agent's first post

xpost sits between your AI agent and your social audience. The agent gets one clean surface — a hosted MCP connector or a REST API — and every post it drafts passes brand guardrails and (in copilot mode) waits for your approval before anything publishes. This page takes you from nothing to a delivered post.

1 · Connect a social account

Start a trial, then connect at least one account under Dashboard → Accounts. Accounts connect through each platform's official sign-in — xpost never sees a password, and tokens are encrypted at rest.

2 · Create an agent API key

Dashboard → Agent → create a key with agent checked. The key (xp_live_…) is shown once — the page offers ready-made connect snippets at that moment. Agent keys are the trust boundary: their posts respect copilot mode and they can never approve anything.

3 · Connect your agent

Easiest is the hosted MCP connector — one URL, no local process. For Claude Code:

claude mcp add --transport http xpost https://dev.xpost.to/api/mcp \
  --header "Authorization: Bearer xp_live_YOUR_KEY"

Claude Desktop, claude.ai, Cursor, and plain REST are covered on the MCP connector page. No MCP? The REST API does everything:

# Which accounts can I post to?
curl -s https://dev.xpost.to/api/v1/social-accounts \
  -H "Authorization: Bearer xp_live_YOUR_KEY"

4 · Make the first post

curl -s -X POST https://dev.xpost.to/api/v1/posts \
  -H "Authorization: Bearer xp_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"caption": "Hello from my agent 🤖",
       "social_accounts": ["<account-uuid>"]}'

In copilot mode the response is the product working as designed:

201 {
  "status": "pending_approval",
  "message": "This project is in copilot mode: the post
              is queued for human approval."
}

The post is now in your approval queue — dashboard, daily digest email, or Telegram. Approve it there. If a guardrail blocked the caption you'll get a 422 with the exact violations instead; rewrite and retry once.

5 · Check the delivery receipt

curl -s "https://dev.xpost.to/api/v1/post-results?post_id=<post-uuid>" \
  -H "Authorization: Bearer xp_live_YOUR_KEY"

Every targeted account gets its own receipt: delivered with a live URL, or failed with the platform's error and retry count. Nothing fails silently.

Where to next