Every reply assistant, scheduler and analytics add-on you connect to X is a third-party app, and connecting one grants that app access to your account rather than merely reading public posts. X documents exactly what an authorised app may do, which permissions it can request and where to revoke them — and those same screens are the fastest audit available for an account that has collected tools for years.
Open Settings and privacy, then Apps and sessions, to see every app with access to your account and every active login session. Revoke anything you no longer recognise or use. Read access lets an app view your posts, profile and timeline; read-and-write access lets it post, delete, reply, Repost and follow on your behalf; a further permission exposes your Direct Messages and a separate one exposes your email address. Authorising an app does not, by itself, entitle it to act automatically.
What connecting an app actually grants
X is explicit that third-party apps are built by external developers and are not owned or operated by X. When you connect one, you are granting it access to use your account, and what it is able to do depends on the permissions it holds — reading your posts, seeing who you follow, updating your profile, posting on your behalf, accessing your Direct Messages, or seeing your email address are all on the documented list.
The help page on third-party apps and sessions groups those abilities into permission sets. Reading them in the platform’s own categories beats reading a vendor’s summary, because the vendor chooses the summary and X writes the permission screen.
| Permission set | What the app can do with your account | What it means for a reply tool |
|---|---|---|
| Read | View your profile information, your posts — including view counts and how others interact with them — your timeline including protected posts, your account settings, who you follow, mute and block, your Lists and your collections | Everything a drafting assistant needs, and nothing more |
| Read and write | All of the above, plus updating your profile, posting posts and media for you, deleting your posts, engaging on your behalf (like, unlike, reply, Repost), managing your account settings, following and unfollowing, and managing Lists and collections | This is the set that can publish without you; it is the permission to identify and understand before you approve it |
| Read, write and Direct Messages | All of the above, plus sending Direct Messages for you and viewing, managing and deleting the Direct Messages you have sent and received | Almost never needed in order to help someone write a public reply |
| Email address | Viewing the email address associated with your account — a separate permission rather than part of profile information | A marketing surface, not a feature; safe to refuse on principle |
One line in that table is worth remembering the next time an extension asks for permission. X states that the email address and phone number on your account are not considered profile information, and that an app cannot view your email unless it is granted that specific permission. If a tool whose only job is drafting text requests it, the request is not about drafting.
Where to see and revoke access
X keeps the controls in one place and names the path directly: Settings and privacy → Apps and sessions. Everything with access to your account appears there, and access can be revoked app by app.
- Sign in and open Settings and privacy.
- Go to Apps and sessions and find the section that lists the third-party apps connected to your account.
- Revoke access for anything you no longer use, do not recognise, or cannot explain. Revoking is the reliable way to stop an app acting with your account.
- Repeat the pass after any week in which you were trialling tools.
X’s own guidance is to be cautious before granting access at all, to decline on the authorisation page if you are not comfortable, and to review the apps holding access regularly to confirm you still want them there. That guidance also settles a familiar argument. A tool that can only read your posts is a different proposition from one that holds write access it never uses: the second can act the moment something changes on the developer’s side, and neither you nor X can predict which change that will be.
Sessions are the other half of the audit
App access and login sessions are separate lists on the same settings page. Under Sessions, X shows every active login connected to your account along with the location and time of login. Each one can be ended individually, or ended together with Log out all other sessions.
One caveat belongs in the same breath. X notes that logging out of a session stops further actions from it, such as posting, liking and replying, but that it may not delete data already cached on the device while that session was active. Ending a session closes the door; it does not rewrite what walked through it. If an account is shared, borrowed, or has been used on a machine you no longer control, the session list is where that shows up.
What X says about consent for automated actions
There is a second agreement underneath the permissions screen, and it is the part most buyers never read. X states that a user authorising an app through OAuth does not, by itself, constitute sufficient consent for that app to take automated actions through the account. Automated actions elsewhere require their own three-step standard, and the same page that sets out the automation rules spells it out.
| What X requires for automated actions | What that looks like in practice |
|---|---|
| The types of automated actions must be clearly described to you | You should be able to say, in one sentence, what the tool does on your behalf and when |
| Your express consent must be obtained for those actions | Installing the app is not the same as agreeing to let it act; the description has to come first |
| An opt-out request must be honoured immediately | Turning it off has to actually stop it, not queue a change for the next release |
| If the app’s purpose or functionality changes substantially, consent has to be obtained again | A quiet product pivot is where the agreement you read stops describing the thing you have installed |
| You remain responsible for actions taken with your account or by applications you associated with it | Permission screens do not transfer the consequence; the account holder carries it |
That is the standard against which a product’s own claims should be read. A drafting assistant asks for a permission set and never performs an automated action, so the three-step standard does not apply to it. A tool that replies, follows or messages on its own is engaged in the activity the rules describe, including the clause requiring prior written and explicit approval for AI reply bots. The permissions screen tells you what an app can do; this section tells you what it is allowed to do. The gap between the two is where account problems live, and it is the reason to check both before approving anything.
Reading permissions like a buyer
Once you know the sets, a product’s permission request becomes a specification of what it intends to do. The claims to test are the vague ones.
| What the tool promises | What it needs to be true | The question to ask |
|---|---|---|
| “Drafts replies for you to review” | Nothing beyond reading the post in front of you; no permission is required to insert text you then send yourself | “Does it hold write access it does not need?” |
| “Schedules posts you wrote” | Read-and-write access, because something has to publish | “Can it publish anything I have not approved?” |
| “Monitors keywords and replies for you” | Read-and-write access plus a defensible answer on opt-in, opt-out and one-reply-per-interaction | “Show me the reply log and the opt-out path” |
| “Adds DM features” | The Direct Messages permission, which also exposes the DMs you have already sent and received | “Why does a writing tool need message history?” |
| “Sends you product emails” | The email permission, granted separately on the authorisation screen | “Can I use the product without granting it?” |
A short version of the same test: match the permission to the promise, and treat any mismatch as the product description. The comparison table keeps the categories of tool apart, the buying filter for AI writing tools applies the platform rules to the shortlist, and the review-first and auto-post breakdown explains why the difference is structural rather than cosmetic. How our own extension is built and what each mode does is documented in the user guide.
A five-minute audit you can repeat monthly
App access accumulates quietly, so the routine matters more than the individual decision. Run it on the first of the month, or after any tool trial.
- List every connected app and write one sentence next to each saying what it does for you today.
- Revoke the ones with no sentence. An app you cannot justify in one line is an app you are not using.
- Check the permission set of what remains against the four rows above. Write access held by a drafting tool is the pattern that matters.
- Scan the session list for logins you cannot account for, and end them.
- Re-read the one-line description you wrote plus the tool’s current feature list. If they no longer match, treat it as a new decision rather than an existing one.
None of that requires technical knowledge, and all of it runs on screens X already provides. The point is not suspicion for its own sake — it is that access granted once is access held until it is revoked, and the review only happens if it is a habit.
Related guides
- Deciding what a tool may do on your behalf? Start with what X’s automation rules actually say.
- Comparing products? The honest comparison table and the buying filter for AI writing tools cut it by workflow rather than feature count.
- If a tool uses the API rather than a browser extension, the API automation rules set out what changes.
Bottom line
Connecting an app to X is a grant of access, not a subscription to a feature, and X gives you both the list of what was granted and a button to take it back. Check the two screens — apps and sessions — before you install anything new, revoke what you no longer use, and read the permission request as the product’s real specification. Our extension is a drafting assistant that works inside X on your own account: what it does, and what it deliberately does not do, is set out in the documentation. Before connecting any tool that touches replies, read what the automation rules require.