How to Automate Scheduled X Posts with Codex and xurl

如何使用 Codex 和 xurl 自动化定时发布 X (Twitter) 推文

Most social-media automation tutorials stop at “call the API on a cron job.” That works, but it leaves the hard questions unanswered. Which account is the automation using? How does it avoid posting the same story twice? What happens when an API request times out after X has already accepted the post? And where should an AI agent’s editorial freedom end? 大多数社交媒体自动化教程到“在 cron 任务中调用 API”就结束了。这确实可行，但它留下了许多棘手的问题：自动化程序使用的是哪个账户？它如何避免重复发布同一条内容？当 API 请求在 X 已经接收推文后超时，会发生什么？以及 AI 代理的编辑自由度应该到哪里为止？

I recently built a scheduled X publishing workflow with Codex and xurl, the official command-line client for the X API. The result is not just a timer attached to an AI prompt. It is a small publishing system with four distinct layers: 最近，我使用 Codex 和 X API 的官方命令行客户端 xurl 构建了一个定时发布 X 推文的工作流。其成果不仅仅是一个连接到 AI 提示词的定时器，而是一个包含四个不同层级的微型发布系统：

1. An X developer application with read-and-write user authentication.
2. xurl, which stores the credentials and communicates with the X API.
3. A fixed-account Codex skill that verifies the identity before every write.
4. A Codex scheduled task that researches, checks history, drafts, and publishes.
5. 一个具备读写用户身份验证的 X 开发者应用程序。
6. xurl，用于存储凭据并与 X API 进行通信。
7. 一个固定账户的 Codex 技能（Skill），在每次写入前验证身份。
8. 一个负责研究、检查历史记录、起草和发布内容的 Codex 定时任务。

That separation is the important part. Codex can make editorial decisions, but it cannot casually choose an account or improvise the publishing command. The skill owns the deterministic write boundary, while the scheduled task owns timing and editorial policy. 这种分离至关重要。Codex 可以做出编辑决策，但它不能随意选择账户或即兴执行发布命令。技能层负责确定性的写入边界，而定时任务层则负责时间安排和编辑策略。

In this article, I’ll show you how to build the same architecture. X developer settings, API packages, Codex features, and command-line options can change. The workflow below was verified in August 2026, but you should check the current upstream documentation before using it in production. 在本文中，我将向你展示如何构建相同的架构。X 的开发者设置、API 包、Codex 功能和命令行选项可能会发生变化。以下工作流在 2026 年 8 月经过验证，但在将其用于生产环境之前，请务必查阅最新的官方文档。

What You Will Need

你需要准备什么

Before starting, you will need: 在开始之前，你需要：

• Codex on a Mac with access to Scheduled tasks.
• An X developer account and an application with read-and-write permissions.
• Homebrew.
• A dedicated or clearly identified X account for the automation.
• A local project containing the source material or editorial context the agent should use.
• 在 Mac 上运行并拥有定时任务访问权限的 Codex。
• 一个 X 开发者账户以及一个拥有读写权限的应用程序。
• Homebrew。
• 一个专门用于自动化或标识明确的 X 账户。
• 一个包含代理所需源材料或编辑背景的本地项目。

You should also decide what the automation is allowed to publish before you give it access to an account. A good editorial policy is specific enough to reject a story, not merely broad enough to describe a topic. For example, I built one version of this workflow for a health-news account. Its policy covered metabolic health, nutrition research, and evidence quality. It also required the agent to distinguish association from causation, label animal studies and preprints, avoid personalized medical advice, and prefer primary sources. Those rules mattered just as much as the code. 在授予账户访问权限之前，你还应该决定自动化程序被允许发布什么内容。一个好的编辑策略应该具体到足以拒绝某篇报道，而不仅仅是宽泛地描述一个主题。例如，我曾为健康新闻账户构建过一个版本，其策略涵盖了代谢健康、营养研究和证据质量。它还要求代理区分相关性与因果关系、标注动物研究和预印本、避免个性化医疗建议，并优先使用原始来源。这些规则与代码本身同样重要。

Install xurl

安装 xurl

Install the official X Developer Platform CLI with Homebrew: 使用 Homebrew 安装官方 X 开发者平台 CLI：

brew install --cask xdevplatform/tap/xurl

Then verify that it is available: 然后验证它是否可用：

command -v xurl
xurl version

The xurl project supports OAuth 2.0 user authentication, multiple applications and accounts, shortcuts for common X actions, media uploads, and raw X API requests. Most importantly for this workflow, it gives us simple commands for identifying the authenticated user, reading account history, and creating a post. xurl 项目支持 OAuth 2.0 用户身份验证、多应用程序和多账户管理、常见 X 操作的快捷方式、媒体上传以及原始 X API 请求。对于此工作流最重要的是，它为我们提供了识别已验证用户、读取账户历史记录和创建推文的简单命令。

Create an X Developer Application

创建 X 开发者应用程序

Open the X Developer Console and create an application for the account you intend to manage. Configure user authentication with these general settings: 打开 X 开发者控制台，为你打算管理的账户创建一个应用程序。使用以下常规设置配置用户身份验证：

Setting	Value
App permissions	Read and write
App type	Web App, Automated App, or Bot
Callback URI	http://localhost:8080/callback
Website URL	A valid website you control
Environment	A production-capable API package

设置	值
应用权限	读写 (Read and write)
应用类型	Web 应用、自动化应用或机器人
回调 URI	http://localhost:8080/callback
网站 URL	你控制的有效网站
环境	支持生产环境的 API 包

The callback URI must match exactly. xurl uses http://localhost:8080/callback by default, although it can store a different redirect URI for an application if necessary. When X asks how you will use its data, describe the real first-party workflow. A suitable statement might explain that the application will create original or scheduled posts, read the account’s own history to prevent duplicates, and retain only minimal operational data such as post IDs, source URLs, timestamps, and publishing status. 回调 URI 必须完全匹配。xurl 默认使用 http://localhost:8080/callback，尽管如有必要，它也可以为应用程序存储不同的重定向 URI。当 X 询问你将如何使用其数据时，请描述真实的自有工作流。一个合适的说明可以是：该应用程序将创建原创或定时推文，读取账户自身的历史记录以防止重复，并仅保留最少的运营数据，如推文 ID、源 URL、时间戳和发布状态。

Know Which Credential You Need

了解你需要哪些凭据

X exposes several credentials that look interchangeable but are not: X 提供了几种看起来可以互换但实际上并非如此的凭据：

• An OAuth 2.0 Client ID and Client Secret are used for the user authorization flow in this tutorial.
• A Consumer Key and Consumer Secret belong to OAuth 1.0a.
• A Bearer Token is commonly used for app-only authentication and is not a substitute for the user context needed to publish as your account.
• 本教程中的用户授权流程使用 OAuth 2.0 客户端 ID 和客户端密钥。
• Consumer Key 和 Consumer Secret 属于 OAuth 1.0a。
• Bearer Token 通常用于仅限应用的身份验证，不能替代以你的账户身份发布推文所需的用户上下文。

Save the OAuth 2.0 Client ID and Client Secret privately. Never paste them into a Codex conversation, a Markdown file, a screenshot, or your source repository. 请私下保存 OAuth 2.0 客户端 ID 和客户端密钥。切勿将其粘贴到 Codex 对话、Markdown 文件、截图或源代码仓库中。

Authorize the Account Locally

在本地授权账户

Credential setup should happen in a private Terminal controlled by you, not inside an agent session. This zsh pattern prevents the literal secret from being recorded in shell history: 凭据设置应在你控制的私有终端中进行，而不是在代理会话中。这种 zsh 模式可以防止明文密钥被记录在 shell 历史记录中：

read "XURL_CLIENT_ID?Client ID: "
read -s "XURL_CLIENT_SECRET?Client Secret: "; echo
xurl auth apps add my-x-app \
  --client-id "$XURL_CLIENT_ID" \
  --client-secret "$XURL_CLIENT_SECRET" \
  --redirect-uri http://localhost:8080/callback
unset XURL_CLIENT_ID XURL_CLIENT_SECRET

Now authorize the intended account. Replace my_handle with the handle without the @ character: 现在授权目标账户。将 my_handle 替换为不带 @ 符号的用户名：

xurl auth oauth2 --app my-x-app my_handle
xurl auth default my-x-app my_handle

The OAuth command opens a browser. Sign in to the correct X account and approve the requested access. Next, verify the setup without publishing anything: OAuth 命令会打开浏览器。登录正确的 X 账户并批准请求的访问权限。接下来，在不发布任何内容的情况下验证设置：

xurl auth status
xurl whoami --username my_handle
xurl posts my_handle -n 100 --username my_handle

The whoami result must contain the exact account you expect. If it does not, stop. Do not “test” the configuration by sending a post from an uncertain identity. Also, never ask an agent to inspect or print anything under ~/.xurl/. That directory contains authentication material. Avoid xurl --verbose in an agent session as well, because verbose request output can expose sensitive headers. whoami 的结果必须包含你预期的确切账户。如果不是，请停止。不要通过以不确定的身份发送推文来“测试”配置。此外，永远不要要求代理检查或打印 ~/.xurl/ 下的任何内容。该目录包含身份验证材料。在代理会话中也要避免使用 xurl --verbose，因为详细的请求输出可能会暴露敏感的标头信息。

Put a Fixed-Account Skill in Front of the API

在 API 前放置一个固定账户技能

Codex skills package repeatable instructions and optional executable logic. According to the OpenAI skill documentation, a skill is a directory with a required SKILL.md file and optional scripts, references, assets, and interface metadata. For this workflow, create a personal skill named something like xurl-post: Codex 技能封装了可重复的指令和可选的可执行逻辑。根据 OpenAI 技能文档，技能是一个包含必需的 SKILL.md 文件以及可选脚本、引用、资源和接口元数据的目录。对于此工作流，创建一个名为 xurl-post 的个人技能：

xurl-post/
├── SKILL.md