TransformerA creator platform should never ask for your X password. With X's own sign-in (OAuth 2.0), you log in on x.com and approve a list of permissions, and the app only gets the scopes it asked for. Read-only sign-in needs just tweet.read and users.read; be cautious with apps that also ask to post for you (tweet.write), read or send your DMs (dm.read, dm.write) or stay connected indefinitely (offline.access) when they don't need to. Transformer asks only for tweet.read users.read, uses the token once to read your profile, then revokes it.
Why shouldn't you give an app your X password?
Because a password gives full control: posting, DMs, settings, even locking you out. X's sign-in exists so you never have to. With OAuth, the app sends you to X, you sign in there, X shows what the app is asking for, and X gives the app a token limited to those permissions. If a platform asks you to type your X password into its own form, or to share a login code, don't.
What X permissions should a creator platform ask for?
X's developer documentation describes each scope. The ones you'll see most:
| Scope | What X says it allows | Does a sponsorship platform need it? |
|---|---|---|
tweet.read |
"All the Tweets you can view, including Tweets from protected accounts" | Required by X for sign-in |
users.read |
"Any account you can view, including protected accounts" | Yes, to read your profile |
tweet.write |
"Tweet and Retweet for you" | Only if it posts for you |
dm.read |
"All the Direct Messages you can view" | Rarely; ask why |
dm.write |
"Send and manage Direct Messages for you" | Rarely; ask why |
offline.access |
"Stay connected to your account until you revoke access" | Only for ongoing actions on your behalf |
X's docs list tweet.read users.read as the scopes for looking up the signed-in user, which is all a sign-in needs. Without offline.access, X's access token is valid for only two hours and no refresh token is issued.
How do you check what an app can do with your X account?
- Look at X's consent screen before you approve. It lists what the app is requesting.
- Question anything beyond read access. Posting or DM access should match a feature you want.
- Read the platform's own explanation of what it does with your account, in its docs or privacy policy.
- Remove apps you no longer use from your X account's connected-apps settings.
- Never share your password or login codes, even with someone claiming to be the platform's support team.
Do you need to give DM access to get brand deals?
No. Brands can reach you through the platform, by email, or by a DM you read yourself on X. A marketplace doesn't need to read your inbox to send you offers.
What Transformer asks for, and what it doesn't
Transformer is the agentic influencer marketplace: real creators, paid on verified posts. Run it from the dashboard or from your agent.
- Sign in with X asks for
tweet.read users.readonly, the minimum X allows. No posting, no DM access, nooffline.access. - The token is used once to read your profile when you sign in, then revoked.
- Transformer never posts for you. You post on X yourself, in your own words with the link and X's Paid partnership label, then submit the post URL.
- Transformer never reads your DMs.
- Your profile and posts are read from X's public data for your creator profile and for verifying sponsored posts.
- You can also sign in with email, Google or GitHub and connect X separately.
Offers show the brand, the brief, the link and what you earn before you accept, and the payment is held before you post. See Is this sponsorship offer legit? Sign up with X.
FAQ
Do influencer platforms need my X password?
No legitimate one should. With Sign in with X (OAuth), you log in on X itself and approve specific permissions; the app never sees your password.
What X permissions does a creator platform need?
For sign-in, tweet.read and users.read. Posting (tweet.write), DM access (dm.read, dm.write) and staying connected (offline.access) should only be requested for features you actually use.
Does Transformer read my DMs or post for me?
No. Transformer asks only for tweet.read users.read, uses the token once to read your profile, then revokes it. You post on X yourself and submit the URL.
How long does an X sign-in token last?
Without the offline.access scope, X's OAuth 2.0 access token is valid for two hours and no refresh token is issued, according to X's developer docs.
How do I remove an app's access to my X account?
Remove it from the connected apps in your X account settings. Tokens with offline.access stay valid until you revoke them.