From X (Twitter) Free API to Basic/Pro: How Postly's X-Pro Integration

A practical migration story - covering auth, token vaulting, rate-limit backoff, observability, billing, and the feature set this unlocks in Postly: Automations, Engagement, AI Inspiration, and Analytics - with no fallback to user-supplied keys.

Note: “X-Pro” in this article is a Postly add-on name, not an official X/Twitter product. We migrated our integration from X/Twitter’s Free API to Basic/Pro tiers behind a single managed app.

Why we killed BYO (Free API) keys

BYO looked attractive: zero infra cost for us, and “let power users manage their own limits.” In practice, it created persistent friction:

• Setup friction: Users had to apply for a developer account, create an app, set the exact callback URL, and choose scopes. Lots of drop-off.
• Unpredictable caps: Free-tier ceilings are low and inconsistent; things broke randomly from the user’s POV.
• Support overhead: We ended up debugging dozens of unique user apps and scope combinations.
• Product limits: We could only offer basic posting. Anything more (scheduled automations, richer analytics, engagement flows) ran into rate-limit chaos.

To build the roadmap customers wanted, we needed reliability and control. That meant a single, managed app and a move to Basic now, Pro next.

What “X-Pro” enables in Postly

Below is the feature surface we’re launching (and actively expanding) now that we have predictable auth and quotas.

✅ Basic Publishing

• Publish Tweets (including Long Tweet format for eligible premium X users).
• Auto-Threads, with optional auto-numbering (e.g., “1/”, “2/”…).
• Polls.
• Alt text on media.
• Tagging.
• Community posts:
  • Post with Community hashtag (e.g., #buildinpublic).
  • Attempt ID/name validation when available; if not publicly verifiable, we post via hashtag only and show a clear message: “Community not validated via API, posting with hashtag only.”

✅ Automations

• Auto Retweet: Re-share your posts automatically at set intervals (e.g., after 1h, 6h, 24h), with repeat and auto-stop options.
• Cross-post to Bluesky: Mirror tweets (text, images, links) to Bluesky.
• Schedule Replies: Queue replies to your tweets/threads for planned campaigns.
• Delay Threaded Tweets: Pacing control between parts of a thread.
• Auto Delete: Auto-remove posts immediately or after a period (24h, 7d, custom).
• Auto Plug: Auto-post the first comment under your tweet (text, links, media).
• Tweet Screenshots → Carousel Posts: Export tweets as images and repurpose as carousels for LinkedIn/Instagram/Facebook.
• Automatic Reposting of Best Tweets: Detect high-performers (likes, retweets, replies, CTR) and repost to extend reach.

🤖 AI Inspiration

• Browse → Select → Rewrite with AI → Publish/Schedule.
• AI Tweet Writer for punchy one-offs.
• AI Thread Writer for multi-tweet narratives.
• AI Content Strategist for themes, hashtags, formats.
• Tweet Inspirations: Discover viral examples by niche, rewrite with AI, queue instantly.
• Viral Hook Library and Tweet Templates.
• Your Best Tweets: Surface your top historical posts to repurpose.

💬 Engagement

• Engagement Builder: Track unlimited users and up to 50 keywords; surface new tweets for quick engagement.
• Social Hub: Curated feed of niche-relevant posts with one-click actions.
• Top Followers & Interactions: Identify your most engaged followers and patterns.
• Auto Comment System: Rule-based comments under your posts or others’ posts.

📊 Analytics

• Account analytics & posting streaks for consistency.
• Unlimited timeframe: we store lifetime data, not just 30 days.
• Detailed post stats: likes, retweets, replies, CTR.
• Follower growth & profile clicks.
• Filter top tweets to find your winners fast.
• Optional public analytics profile to share with your audience.

Billing, plans, and limits

X/Twitter publishing is only available via X-Pro inside Postly. It is not sold per channel on Free, LTD, Basic, or Team plans.

Pricing: $30/month per connected X account or $288/year (20% off).

Posting allowance: “Unlimited” posts per account per month with fair usage.

Engagement: unlimited users tracked; up to 50 keywords per account.

We’ve removed the Free plan connection method entirely. We’re standardizing on Twitter API Basic now (Postly pays), and we’ll migrate to Pro next.

Fair Usage Policy (how we enforce “unlimited” responsibly)

We’re transparent with the developer community about how we keep the platform healthy. The specifics below are internal guardrails; the product UI surfaces only the messages users need.

• Provider constraints today (Basic): ~15,000 posts/month total across all connected accounts on our app.
• Postly soft cap per account: 500 posts/month/account. This keeps the fleet fair while we’re on Basic.

Enforcement behavior:

• We track monthly post counts per X account (UTC window).
• On crossing 500, we block further posts for that account until reset or show a clear UI message: “Posting limit reached for this account. Please contact support.”

Escalation / upgrade path:

• On Basic ($200/mo from X), we can support roughly 30–75 users depending on intensity.
• We will move to Pro ($5k/mo) to scale toward ~2,000 users at 500 posts/account.

Ops practice:

• We flag accounts that hit 80% of the cap (400+) for monitoring.
• Monthly counters reset on the 1st (UTC).
• Support can allocate higher allowances as we migrate to Pro.

Architecture in brief (no code, just decisions)

• Single managed app on X → consistent scopes, predictable limits, uniform logs.
• User-context tokens, vaulted and encrypted (KMS-style key-wrapping; no plaintext at rest).
• A thin gateway in front of X:
  • Exponential backoff + jitter and graceful “pause until reset” when rate-limited.
  • Idempotency and deduplication for scheduled jobs.
  • Structured logs, metrics, and traces so we can answer “is it us or the API?” quickly.
• Jobs, not direct calls: every action (post, like, reply, delete) is a job with an idempotency key. Retries are a first-class behavior, not an afterthought.
• Observability: metrics for call counts, latencies, rate-window remaining, and backoff histograms; dashboards per account/family; alerts when we approach caps.

OAuth and token vaulting (principles)

• Clear, productized connect flow (no dev-portal steps).
• On callback, we validate state/nonce, exchange the code, and store user-context tokens.
• Tokens are encrypted with per-record data keys, wrapped by a central KMS key.
• We keep scopes, expiry, and account identifiers for routing and pre-emptive refresh.
• We never render tokens to logs or clients; sensitive reads are audited.

Handling real-world rate limits (without code)

• We read rate-limit headers, record window data, and pause dispatch for that account/endpoint until reset (with a small safety buffer).
• Exponential backoff + jitter for transient errors (429/5xx/network blips).
• Idempotency prevents duplicates when retries occur (both at enqueue and delivery).
• The UI explains what’s happening: “Resuming at 13:07:15 UTC” beats “please try again later.”

Rollout plan and risk controls

• Feature-flagged internal, then controlled customer cohorts.
• “Shadow” observation window to size buffers safely before ramp-up.
• Guided re-connect UX; no imports of user-created apps.
• No fallback to BYO keys to keep the system surface area small and support crisp.
• We’ll migrate to Pro when we approach Basic’s fleet limits.

What we learned

• If your product’s value depends on dependable posting and telemetry, own the integration. BYO looks flexible but fragments your SLOs.
• Idempotency, backoff, and rate windows are not “infra fluff”—they’re core product behaviors. When you surface them clearly, users trust you more.
• Observability pays for itself the first time you need to answer “is it us or X?” in under a minute.
• A clear Fair Usage policy lets you say “unlimited” without burning the commons.

What’s next

• Expanding Automations (branching rules, multi-account orchestration).
• Deeper Engagement workflows with better safety rails.
• More AI Inspiration modes tuned by your analytics and niche.
• Richer Analytics that explain why a post paused or popped.
• We’ll continue refining the gateway, limit modeling, and UX nudges as we move from Basic to Pro.

Final word

If you’re considering the same migration, ask:

• Are you spending more time debugging user apps than your own?
• Do your customers need features that demand predictable quotas?
• Are support and analytics hamstrung by inconsistent auth?

If yes, a single managed app on Basic/Pro (with no BYO fallback) will likely pay for itself in product quality and developer sanity. If you want to compare notes (auth, token vaulting, limit modeling, or observability), I’d love to hear how you’re approaching it - and what you’d do differently.

Thanks for reading. If this helped, share your own migration lessons - #buildinpublic makes all of us better. Learn more about how Postly can help streamline your social media management.