How to Limit a Connected App to Sharing Permissions on X

Is this your situation?

The short answer

Before you start

• Check what the app is requesting Look at the permissions list shown before you approve the app.Verify: Confirm whether it lists read access, write access, or Direct Message access.
• Check the app's own policies Review the app's terms and privacy policy before authorizing it.Verify: Look for how the app says it will use your account data.
• Check for granular access options OAuth 2.0 User Context can let a developer set more granular access for an app.Verify: Look at the approval screen for separate lists of what the app can view and do.

How X handles this

• Apps with read access can see who you follow, mute, and block.
• Apps with read and write access can post, delete posts, and engage with posts on your behalf.
• Apps with read, write, and Direct Message access can send, view, and manage your Direct Messages.
• Under OAuth 2.0, write permissions cover actions like posting, reposting, and following or unfollowing people.

Step by step

1. Start the authorization Go to the app's sign-in or connect option for X.Confirm: Check that the page you land on starts with https://x.com.
2. Review the permissions screen Look at the lists under what the app can view and what it can do.Confirm: You see a list of things the app is requesting permission to view.
3. Review the write permissions Check the second list for actions the app wants to take.Confirm: You see a list of things the app is requesting permission to do.
4. Decide whether to proceed Cancel if the permissions go further than sharing content on your behalf.Confirm: Clicking cancel declines the app's access request.
5. Connect if the scope fits Confirm the connection if you are logged in and the permissions match what you want.Confirm: The Authorize app button connects the app when you are already logged in.
6. Check email access separately You want to know if the app can see your email address.Confirm: An app will not view your email address unless you grant specific permission.
7. Review the connection afterward Open the Apps and sessions section to see what the app can do.Confirm: The section displays all apps connected along with their specific permissions.
8. Revoke if the scope is wrong Remove the app's access if it has more than sharing permissions.Confirm: Clicking Revoke access disconnects the app from the account.

Common mistakes

• Assuming cancel still connects the app Clicking cancel on the authorization page declines the app's access request.Why it happens: The cancel option is overlooked on the approval screen.
• Not checking what read access already includes Read access can show account settings such as preferred language and time zone.Why it happens: Sharing permissions sound narrower than what is actually granted.
• Leaving an unwanted app connected You can revoke access for apps you do not recognize from the Apps and sessions section.Why it happens: Review and revoke gets skipped once the app is connected.
• Treating read access as harmless Apps with read access can view protected posts from accounts you follow.Why it happens: Read-only sounds limited but covers more than posts you post.

Roles at a glance

Keeping track of who has access