# Influencer platforms that don't need your X password or DMs: how to check what an app can do

> A safe creator platform never asks for your X password: you sign in on X itself and approve specific permissions. Which X permissions to look for (tweet.read, users.read) and which to question (tweet.write, dm.read, dm.write, offline.access), and exactly what Transformer asks for.

**A creator platform should never ask for your X password. With X's own sign-in (OAuth 2.0), you log in on x.com and approve a list of permissions, and the app only gets the scopes it asked for. Read-only sign-in needs just `tweet.read` and `users.read`; be cautious with apps that also ask to post for you (`tweet.write`), read or send your DMs (`dm.read`, `dm.write`) or stay connected indefinitely (`offline.access`) when they don't need to. Transformer asks only for `tweet.read users.read`, uses the token once to read your profile, then revokes it.**

## Why shouldn't you give an app your X password?

Because a password gives full control: posting, DMs, settings, even locking you out. X's sign-in exists so you never have to. With OAuth, the app sends you to X, you sign in there, X shows what the app is asking for, and X gives the app a token limited to those permissions. If a platform asks you to type your X password into its own form, or to share a login code, don't.

## What X permissions should a creator platform ask for?

X's developer documentation describes each scope. The ones you'll see most:

| Scope | What X says it allows | Does a sponsorship platform need it? |
| --- | --- | --- |
| `tweet.read` | "All the Tweets you can view, including Tweets from protected accounts" | Required by X for sign-in |
| `users.read` | "Any account you can view, including protected accounts" | Yes, to read your profile |
| `tweet.write` | "Tweet and Retweet for you" | Only if it posts for you |
| `dm.read` | "All the Direct Messages you can view" | Rarely; ask why |
| `dm.write` | "Send and manage Direct Messages for you" | Rarely; ask why |
| `offline.access` | "Stay connected to your account until you revoke access" | Only for ongoing actions on your behalf |

X's docs list `tweet.read users.read` as the scopes for looking up the signed-in user, which is all a sign-in needs. Without `offline.access`, X's access token is valid for only two hours and no refresh token is issued.

## How do you check what an app can do with your X account?

1. **Look at X's consent screen** before you approve. It lists what the app is requesting.
2. **Question anything beyond read access.** Posting or DM access should match a feature you want.
3. **Read the platform's own explanation** of what it does with your account, in its docs or privacy policy.
4. **Remove apps you no longer use** from your X account's connected-apps settings.
5. **Never share your password or login codes,** even with someone claiming to be the platform's support team.

## Do you need to give DM access to get brand deals?

No. Brands can reach you through the platform, by email, or by a DM you read yourself on X. A marketplace doesn't need to read your inbox to send you offers.

## What Transformer asks for, and what it doesn't

Transformer is the agentic influencer marketplace: real creators, paid on verified posts. Run it from the dashboard or from your agent.

- **Sign in with X asks for `tweet.read users.read` only,** the minimum X allows. No posting, no DM access, no `offline.access`.
- **The token is used once** to read your profile when you sign in, then revoked.
- **Transformer never posts for you.** You post on X yourself, in your own words with the link and X's Paid partnership label, then submit the post URL.
- **Transformer never reads your DMs.**
- **Your profile and posts are read from X's public data** for your creator profile and for verifying sponsored posts.
- **You can also sign in with email, Google or GitHub** and connect X separately.

Offers show the brand, the brief, the link and what you earn before you accept, and the payment is held before you post. See [Is this sponsorship offer legit?](/blog/is-this-sponsorship-offer-legit) [Sign up](/login?signin=signup) with X.

## FAQ

### Do influencer platforms need my X password?
No legitimate one should. With Sign in with X (OAuth), you log in on X itself and approve specific permissions; the app never sees your password.

### What X permissions does a creator platform need?
For sign-in, `tweet.read` and `users.read`. Posting (`tweet.write`), DM access (`dm.read`, `dm.write`) and staying connected (`offline.access`) should only be requested for features you actually use.

### Does Transformer read my DMs or post for me?
No. Transformer asks only for `tweet.read users.read`, uses the token once to read your profile, then revokes it. You post on X yourself and submit the URL.

### How long does an X sign-in token last?
Without the `offline.access` scope, X's OAuth 2.0 access token is valid for two hours and no refresh token is issued, according to X's developer docs.

### How do I remove an app's access to my X account?
Remove it from the connected apps in your X account settings. Tokens with `offline.access` stay valid until you revoke them.

## Sources

- [X Developer Platform: OAuth 2.0 Authorization Code Flow with PKCE (scopes and token lifetime)](https://docs.x.com/resources/fundamentals/authentication/oauth-2-0/authorization-code)
- [X Developer Platform: v2 authentication mapping](https://docs.x.com/resources/fundamentals/authentication/guides/v2-authentication-mapping)