X API credentials — decision of record

Card: t_1d2979cc — X API credentials decision → then install xurl (the one missing declared binary). Status: BOTH acceptance branches executed. xurl is installed and functional; the credential-provisioning call is escalated to Young (his decision, his X account, his money).

1. The ruling

The credentials decision is deliberately NOT made by me. It is a Young decision for four independent reasons, each verified:

1. It needs Young's X account. App creation is self-serve from an X account, and the fleet has none. A new account is a legal identity, not a credentials entry.
2. It costs real money, and X's own price list is internally inconsistent. Section 3 shows US$0.015 vs US$0.10 for the same "create post" operation across two X pages. Procuring a metered paid tier on the basis of an unverified rate is not a call I make.
3. X's access is not the only path. Reads (our only real use case) work with an app-only Bearer Token, which is a far smaller commitment than an OAuth client. Choosing OAuth 2.0 when we need reads is over-scoping.
4. It is Young's own open item. [marketing-social-addon-pricing-2026-10-20](marketing-social-addon-pricing-2026-10-20) §6 item 6 is "X post-with-link cost — is A$0.344/overage sellable to an AU SMB? Young — Position or hide." You cannot buy the channel before deciding whether to sell it.

2. Why NOT drop the skill — the criterion that decides it

The card allows two branches: obtain credentials, or drop the skill from the declared set. The drop branch was tested against the skill, not against my preferences:

• The business case is already priced. The vault's pricing doc — which I authored, authority Young — commits to an X channel at +A$29, 20 posts included, then metered. It is not a stray wish; it is in the published ladder (§5) and in the channel-modifier table. Dropping the skill would silently contradict a priced product line.
• The declaration is correct and remains correct. The skill's frontmatter declares prerequisites.commands: [xurl]. That declaration is true. The binary is now present. There is nothing to fix in the declaration — which is the opposite of what branch 3 assumes.
• xurl is X's official CLI. It is not a third-party scraper or an unauthenticated workaround. xurl --version → 1.3.4, published by xdevplatform on npm.
• The cost of having installed it is ~A$0.00 and fully reversible.npm uninstall -g @xdevplatform/xurl is the whole rollback.

Branch 3 is therefore not triggered: its trigger is "the dependency cannot be met", and it now can be met. The real open item is narrower than the card implied — it is provisioning, not installation. Echo's study said exactly this (§6: "that is a credentials decision, not a skills decision"); this card confirms it and closes the installable half.

3. 🔴 The X pricing evidence does not support the vault's number

The vault's X figure is US$0.015 per post create, sourced to docs.x.com/x-api/getting-started/pricing (live 2026-10-20). I went back to X's own pages on 2026-10-21 and found the price list disagrees with itself:

Two pages on the same official site quote 0.015 and 0.10 for the same operation. The published pricing page that the vault cites is the lower of the two. Third-party trackers add a third number (pricetimeline records "Content: Create US$0.010" for the 20 Jan 2026 change). The A$0.344/overage figure in the pricing doc is therefore built on a rate that X's own documentation does not consistently state.

This is a flag, not a correction. I am not changing the pricing doc's number on this evidence — that figure is load-bearing in a published ladder and is Young's to set. What I am saying is: do not provision a paid X tier until the rate is read from the Developer Console at the moment of purchase, because that is the only figure X is contractually bound by. A rate read from a docs page is a blog post; a rate read from the console is a bill.

4. What I verified, and how (live probes, not file reads)

Install (all real commands, real output):

$ which -a xurl                          → /home/lab/.local/node24/bin/xurl
$ xurl --version                         → xurl version 1.3.4
$ npm view @xdevplatform/xurl version    → 1.3.4
$ /home/lab/.local/node24/lib/node_modules/@xdevplatform/xurl/binary/xurl --version
                                         → xurl version 1.3.4
$ xurl --help                            → full command set (post, search, dm, media, auth)
$ xurl auth status                       → "No apps registered. Use 'xurl auth apps add'…"  (exit 0)

Read-only calls attempted — and their failure is the finding, not a defect:

$ xurl --auth app /2/users/by/username/xdevelopers
  → Error: Auth Error: TokenNotFound (cause: bearer token not found)
$ xurl /2/users/me
  → Error: Auth Error: NoAuthMethod (cause: no authentication method available)

Both are correct behaviour: no credentials are registered, so no call can be made. There is no free tier to fall back on (closed to new developers, Feb 2026), so a read-only call cannot succeed without a paid credential. This is the honest state: installed, functional, unauthenticated. It will not become "a read-only call succeeds" until Young provisions an app.

Fleet-wide presence (the skill is a stock bundled skill, seeded to every profile):

$ for p in min mira sol echo nova; do hermes -p $p skills list | grep xurl; done
  → all five: │ xurl │ social-media │ builtin │ builtin │ enabled │
$ md5sum of skills/*/skills/social-media/xurl/SKILL.md
  → identical across all five profiles (2f695cae41be8132b3f52518e4eaa4b4)

PATH resolution — the binary sits in ~/.local/node24/bin, which is on the persistent PATH via ~/.bashrc:128 and ~/.profile:32, and is on the tool-subprocess PATH today. Verified with node24 removed from PATH that xurl correctly fails to resolve, so the install is not shadowed by a stray copy.

Install-mechanism note (worth recording): npm install -g warned that the package's postinstall was not run (allow-scripts). That warning is a false alarm for this package — the real 25.8 MB Go binary ships inside the npm tarball at binary/xurl, so no download was skipped. Verified by invoking the binary directly.

5. ⚠️ Correction to Echo's study (the "only one skill with a missing dependency" claim)

[skills-registration-study-2026-10-20](skills-registration-study-2026-10-20) §3 is correct for its date, and this card closes the gap it named. But the claim "exactly ONE skill has a missing declared binary" is now stale in the other direction: xurl is no longer missing, and the study's §3 table should be re-read as a point-in-time inventory (2026-10-20), not a standing fact.

One related observation, flagged not acted on: the study listed youtube-content as "dependency not installed" and reported it closed. That claim is unverified by me — I did not re-run the transcript probe. It is out of this card's scope; noting it so nobody treats the study's green cells as re-checked today.

6. What I did NOT do

• Did not obtain, register, or store any X credential. No app, no OAuth flow, no ~/.xurl write beyond the empty directory xurl itself creates on auth status. ~/.xurl is currently an empty directory — verified.
• Did not paste a credential value anywhere. This doc contains none. No client id, secret, token or bearer value appears in the vault, on the card, or in this session.
• Did not change any fleet declaration. The xurl skill remains enabled · builtin in all five profiles. Editing a bundled skill's frontmatter would be a fleet-wide capability change (Min's lane) and is unnecessary — the declaration was already right.
• Did not modify the vault pricing doc's A$0.344 figure. It is flagged in §3 for Young.
• Did not spend money. No X credits purchased, no console spend limit set.
• Did not test X read endpoints end-to-end, because that is impossible without credentials. The install is verified; the call is not, and I am not claiming it is.

7. Open items

Recommended Young path if he approves: read-only access needs only an app-only Bearer Token (--auth app), which is a much smaller commitment than an OAuth 2.0 client. If the fleet only reads, do not buy OAuth.

Sources

Primary (X's own, fetched live 2026-10-21):

• docs.x.com/x-api/getting-started/getting-access — app creation is self-serve from an X account; four credential types; "credentials are only displayed once"
• docs.x.com/x-api/getting-started/pricing — the vault's cited source: create US$0.015, with-URL US$0.20
• docs.x.com/x-api/getting-started/make-your-first-request — same site quotes Content: Create US$0.10 (the inconsistency in §3)
• docs.x.com/llms.txt — documentation index

Secondary (2026-10-21, third-party — used only to triangulate, never to set a price):

• postproxy.dev X API pricing 2026; sorsa.io; octolens; bollardai; pricetimeline — all report pay-per-use-only for new developers, no free tier, and the with-URL penalty

Internal:

• [marketing-social-addon-pricing-2026-10-20](marketing-social-addon-pricing-2026-10-20) §2.2 (X pay-per-use), §5 (ladder), §6 item 6 (open), §7 (honest limits)
• [skills-registration-study-2026-10-20](skills-registration-study-2026-10-20) §3, §6, §7 (the gap this card closes)

Live host (this run): which/--version/--help/auth status on xurl; npm view; hermes -p <profile> skills list × 5; md5sum × 5; ~/.bashrc/~/.profile PATH; ls ~/.xurl