Xquik

Public tweet, profile, follower, reply, timeline, community, and list reads need no connected X account. Every X write requires one. Private reads, including DMs and bookmarks, also require one. SeeConnect X account.

This page covers the API MCP server athttps://xquik.com/mcpfor authenticated account actions and guest paid reads. For public documentation search, use theDocs MCP serverathttps://docs.xquik.com/mcp.

Codex CLI 0.147.0 and newer preserve the RFC 9207issvalue. Older Codex and affected Goose releases may discard it before token exchange. FollowCodex and Goose OAuth issuer validationto upgrade Codex or use an environment-backed API key.

Xquik compatibility discovery metadata is available at:

GETandPOSTrequests to/.well-known/mcp.jsonreturn an Xquik compatibility discovery document based on the official MCP Registryserver.jsonmanifest.GET /server.jsonandGET /.well-known/mcp/server-card.jsonreturn the same compatibility document. Its standardremotesentry identifies thestreamable-httpendpoint. Extra top-level convenience fields preserve compatibility with older clients, but they are not MCP Registry or experimental MCP Server Card fields. OAuth-aware clients readGET /.well-known/oauth-protected-resource/mcpfor protected-resource metadata forhttps://xquik.com/mcp. Compatibility clients can also readGET /.well-known/oauth-protected-resource/.well-known/mcp.json, which redirects to the canonical metadata URL.

Registry-compatible clients receive astreamable-httpremote forhttps://xquik.com/mcp. OAuth-capable clients discover authentication from the endpoint. Clients without OAuth may send an API key asAuthorization: Bearer {XQUIK_API_KEY}orx-api-key: {XQUIK_API_KEY}. Create API keys athttps://dashboard.xquik.com/en/account?tab=api-keys. The direct client examples below use OAuth. Use the API-key fallback only when the client documents secure request headers.

Agent discovery metadata is also available athttps://xquik.com/.well-known/agent-index.json. That index listscom.xquik/mcp,https://xquik.com/mcp,https://xquik.com/.well-known/mcp.json, the OAuth authorization metadata, the protected-resource metadata, andhttps://xquik.com/auth.md. Theauth.mdfile explains Client ID Metadata Documents (CIMD), Dynamic Client Registration (DCR), PKCE, and themcp:toolsscope.

DCR athttps://xquik.com/api/oauth/registeris the supported anonymous OAuth client registration path when a client cannot use CIMD.

Agent Skills discovery is available athttps://xquik.com/.well-known/agent-skills/index.json. It publishes a SHA-256 digest for Xquik's hostedSKILL.mdso compatible agents can verify the downloaded instructions.

Xquik supports MCP2026-07-28at the same Streamable HTTP endpoint. Current clients start withserver/discover. They do not callinitializeor create a session for a modern connection.

Use a current MCP SDK. It adds the request_metaenvelope and required HTTP headers automatically. Modern requests must advertise bothapplication/jsonandtext/event-stream.

server/discoverandtools/listinclude private cache hints with a 5-minute TTL. Clients can reuse those results for the same authorization context. Never share privately cached catalogs across users or credentials.

Xquik also accepts stateless 2025-era clients at the same endpoint. This keeps existing integrations working while current SDKs adopt2026-07-28.

Modern Xquik connections are request-scoped. Ignore legacy session IDs and resume state. Let the client SDK negotiate the protocol.

Unauthenticated requests tohttps://xquik.com/mcpreturn401with aWWW-Authenticate: Bearerchallenge. The challenge includesresource_metadata="https://xquik.com/.well-known/oauth-protected-resource/mcp",scope="mcp:tools", and the OAuth realm. The JSON body is{ "error": "Authentication required" }. OAuth-capable clients use the challenge to discover the authorization metadata. API-key clients should sendx-api-keyon the first request. A supplied invalid bearer token addserror="invalid_token"anderror_description="Invalid access token"to the challenge.

The MCP server supports 2 authentication methods:

- OAuth 2.1(recommended): Compatible clients discover Xquik, open the browser login and consent flow, then store and refresh Bearer tokens. Xquik supports CIMD and DCR. No manual client ID, client secret, or API key is required for normal client setup.
- API key(x-api-keyorAuthorization: Bearer xq_your_api_key_here): This is an Xquik-specific fallback, not an OAuth token. Do not apply OAuth discovery or refresh rules. Use it only with secure header storage. Full account keys expose 120 catalog routes. Active guest keys expose 33paid_readsGET routes.

SeeOAuth 2.1 authorizationfor discovery URLs, token lifetimes, client registration, and implementation details.

OAuth and full account API key behavior remain unchanged. A pending guest key cannot execute paid reads until verified payment activates it.

The MCP server uses acode-execution sandbox modelwith 2 tools:

The AI agent writes async JavaScript arrow functions that run in a sandboxed environment. Authentication and required idempotency headers are injected automatically.

The code-mode design keeps the endpoint catalog outside the client context. Both tools publish titles and Model Context Protocol safety annotations so clients can distinguish read-only discovery from authenticated execution.

For a guestpaid_readssession,xquikis read-only, idempotent, and limited to live calls across the 33 eligible GET routes.

Searches the 120-route full account catalog. The call uses no credits. MCP authentication remains required. The sandbox provides:

With a guestpaid_readskey,spec.endpointscontains only the 33 eligible GET read routes.

Choose the authentication path that your current client can complete. Xquik keeps OAuth issuer, redirect, resource, and Proof Key for Code Exchange (PKCE) validation enabled for every client.

Clients that ignore the optional RFC 9207issresponse parameter can still complete OAuth. Codex CLI 0.147.0 and newer preserve the value. Older Codex and affected Goose releases may require the parameter after discarding it, so retrying OAuth cannot repair those callbacks. Xquik does not weaken issuer validation.

Leave the advanced client ID and client secret fields empty. Custom remote connectors require Pro, Max, Team, or Enterprise. On Team and Enterprise, an Owner or Primary Owner must add the connector first.

API-key fallback is client-specific. ChatGPT custom apps require OAuth and cannot present custom API keys. Codex uses the environment-backedbearer_token_env_varconfiguration above. For other clients, follow that client's documented secret-input or environment-variable syntax. Never copy a generic header example into an incompatible schema, place a literal key in a configuration file, or commit a key.