Build1 publisher3 min readPublished
The agent writes the copy, not the API call: a fixed-account X publishing skill
A Codex-and-xurl walkthrough splits scheduled posting into four layers so the model never picks the account or shapes the request. The separation is the design; the cron job is trivia.
The Engineer · Build desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- A tutorial titled "How to Automate Scheduled X Posts with Codex and xurl", published on dev.to under the handle designly, describes a scheduled X publishing workflow the author built with Codex and xurl.
- xurl is described as the official command-line client for the X API; it supports OAuth 2.0 user authentication, multiple applications and accounts, shortcuts for common X actions, media uploads, and raw X API requests, and provides commands for identifying the authenticated user, reading account history, and creating a post.
- The workflow has four distinct layers: an X developer application with read-and-write user authentication; xurl, which stores the credentials and communicates with the X API; a fixed-account Codex skill that verifies the identity before every write; and a Codex scheduled task that researches, checks history, drafts, and publishes.
- The author writes that Codex can make editorial decisions but cannot casually choose an account or improvise the publishing command: the skill owns the deterministic write boundary, while the scheduled task owns timing and editorial policy.
- Of the four layers, three (the developer application, xurl, and the fixed-account skill) are fixed configuration, and one (the scheduled task) is where the model exercises editorial judgement.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
A developer publishing as designly has written up a scheduled X posting workflow built on Codex and xurl, the official command-line client for the X API [1][2]. The useful part is not the timer but the boundary: the system is cut into four layers so the model keeps editorial latitude and never gets the choice of account or the shape of the publishing command [3][4].
The layers, as the author lists them: an X developer application with read-and-write user authentication; xurl, which stores the credentials and talks to the API; a fixed-account Codex skill that verifies the identity before every write; and a Codex scheduled task that researches, checks history, drafts, and publishes [3]. Three of those four are fixed configuration, and only the last one holds anything resembling judgement [5]. The author states the split directly: the skill owns the deterministic write boundary, the scheduled task owns timing and editorial policy [4].
The detail carrying the most weight is that identity is verified before every write rather than once at install [3]. An agent session that can be re-prompted, resumed, or handed a different working directory is exactly the kind of caller you do not trust to remember which account it is. Reading the account's own history to prevent duplicates sits in the same category of cheap, deterministic checks, and the author treats it as part of the declared first-party purpose of the application along with retaining only minimal operational data such as post IDs, source URLs, timestamps, and publishing status [6].
Credential handling follows the same instinct. The author points out that X exposes several credentials that look interchangeable and are not: OAuth 2.0 Client ID and Secret drive the user authorization flow used here, Consumer Key and Secret belong to OAuth 1.0a, and a Bearer Token is app-only authentication that cannot substitute for the user context needed to post as your account [7]. Setup is meant to happen in a private Terminal you control rather than inside an agent session, using a zsh read pattern that keeps the literal secret out of shell history and unsetting the variables afterwards [8]. Secrets are never to be pasted into a Codex conversation, a Markdown file, a screenshot, or the source repository [9]. That is not paranoia; a repo is a place agents read.
Editorial policy is treated as engineering rather than preamble. The author's test is that a policy should be specific enough to reject a story, not merely broad enough to describe a topic [10]. The worked example, a health-news account, required the agent to distinguish association from causation, label animal studies and preprints, avoid personalized medical advice, and prefer primary sources [11].
Two things to watch. The piece opens by naming the failure case it does not resolve in the setup material: what happens when an API request times out after X has already accepted the post [12]. Until that path is defined, the duplicate-prevention story rests on history reads rather than idempotency. Second, the workflow was verified in August 2026, and the author warns that developer settings, API packages, Codex features, and command-line options change [13]. The callback URI must match exactly, with xurl defaulting to http://localhost:8080/callback [14], which is the sort of value that breaks quietly after an upstream revision.