Is Automating Your X Posts Against the Rules? What X Actually Allows in 2026

What kinds of X post automation are explicitly allowed?

The April 2026 Automation rules open with a short do-list: build solutions that automatically broadcast helpful information in posts; run campaigns that auto-reply to users who already engaged with your content; and respond to users in Direct Messages after they opted in. None of those require a special partnership. X also ships a native scheduler inside its desktop composer — Sprout Social's 2026 scheduling guide notes you can queue a post up to 18 months ahead — which settles whether delayed publishing is acceptable in principle.

Section II.B.1 is the scheduling clause: automated posts from outside sources (an RSS feed, weather data) are allowed when you are authorized to publish that information, and other automated posts for entertainment, informational, or novelty purposes are allowed if they are not duplicative or spam. That is the rule a founder's Sunday-night queue sits under.

The qualifying condition is the transport layer. The same rules say you may not use non-API-based automation such as scripting the X website, and that those techniques can result in permanent account suspension. A scheduler that asks for your X username and password instead of routing you through OAuth is describing its own violation.

One nuance from section II.A is worth knowing: a user authorizing an app through OAuth does not by itself constitute sufficient consent for that app to take automated actions through the account. The app still has to describe the automated actions, receive express consent, and honor an opt-out. OAuth grants technical permission; the rules still govern which actions are acceptable. An app cannot point at your token as justification for mass-following on your behalf.

What kind of X automation gets your account suspended?

The prohibited list is short and quoted from the April 2026 Automation rules:

• Automated likes— “You may not like posts or hide replies in an automated manner” (II.D).
• Bulk, aggressive, or indiscriminate follow/unfollow — prohibited under II.D and the X Rules on aggressive following. About X limits still lists a technical ceiling of 400 follows per day, and a second brake once an account follows 5,000 others (archived 12 June 2026).
• Keyword-triggered auto-replies— “sending automated replies to posts based on keyword searches alone is not permitted” (II.B.2). Following you is not, by itself, opt-in.
• Unsolicited bulk DMs — automated Direct Messages only after the recipient has requested contact; following you is not enough (II.C).
• Duplicate or near-duplicate content posted on one account or across accounts you operate (I.A, spam). You also may not automate posts about trending topics to try to move a trend.
• Bulk or spammy automated Reposts — II.D permits automated Reposts or Quote posts for entertainment, informational, or novelty purposes, then says bulk, aggressive, or spammy Reposting is a violation of the X Rules. Allowed in principle is not the same as a mass-repost script.
• AI reply bots that send on their own without prior written approval (II.B.3) — see below.

The severity ladder is described in the same document: automated applications that violate these rules, or that induce users to violate them, may be rate-limited, filtered from search, or suspended, and developers can lose API access. The asymmetry is the point: the upside of an auto-follow script is a few dozen followers; the downside is the account.

What did the February 2026 API change do to automated replies?

Policy and plumbing are different layers. II.B.2 already banned keyword-spray replies. On 23 February 2026 X also changed the self-serve write path so those replies fail even if a developer ignored the policy.

PiunikaWeb (24 February 2026) reported the rollout: replies sent through POST /2/tweetsnow succeed only when the original author mentions the posting account or quotes its post. The rule applies to Free, Basic, Pro, and pay-per-use. Enterprise customers and Public Utility apps are the named exceptions. Automated main posts — not replies — were left unchanged. Manual replies typed in the client are outside the restriction. Nikita Bier, X's head of product, framed the first step as closing the front door so an automated reply requires an invitation (a mention or a quote).

Roboin (24 February 2026) published the same two conditions and pointed at X's developer announcement, “Update to Reply Behavior in X API v2 – Restricting Programmatic Replies.” If you need unsolicited high-volume replies (moderation, customer service at scale), X's own note points at Enterprise — not a workaround on pay-per-use.

That is why a compliant 2026 reply workflow drafts in software and sends in a browser. A Chrome extension that fills a reply box you still click is a human reply. A script that posts replies through the self-serve API to strangers is both a policy violation and, after 23 February, a failed request.

Do AI reply bots need written approval from X?

Yes, if they post without a human send. Automation rules II.B.3 — added in the April 2026 update — says you may use AI to create automated reply bots that generate dynamic, context-aware responses,but “the deployment or operation of any AI reply bot requires prior written and explicit approval from X.” The path they name is your dedicated point of contact or a request through the developer portal. Advertisers, publishers, and brands running auto-response campaigns are told separately (II.B.2 note) to request approval from X.

That clause covers autonomous senders. A workflow where a model surfaces conversations and drafts replies, and you read and approve each one before it goes out, keeps the judgment human — which is the whole substance of the rule. That is the design behind our AI-assisted reply workflow, and it is why the approval step is not optional in it.

Does using a third-party scheduling tool put your account at risk?

Not from the scheduling. The risk lives in three specific tool behaviors, and you can check for all three before connecting anything.

First, authentication method. If the sign-up flow bounces you to x.com and shows X's own authorization screen listing requested permissions, the tool is on the API. If it asks for your password inside its own form, it is driving a browser session, which the April 2026 rules prohibit. Second, engagement features. A tool offering “auto-follow back,” “auto-like your niche,” or unattended keyword replies is selling you a policy violation with a subscription attached. After 23 February 2026 those API replies also fail on self-serve tiers unless the author invited you. Third, content duplication. Tools that recycle the same post text on a loop, or fan one post across several accounts you control, run into the duplicate-content rule independently of how the posts are transmitted.

Reply workflows sit in the interesting middle. Automated replies to strangers are prohibited; a human sending replies faster with help is not. The distinction is where the send decision lives.

Do you have to label your account as a bot if you schedule posts?

Only if the account is genuinely automated. X's profile-label help article (Wayback, 25 June 2026) describes an “automated” account label for accounts generating content not produced by a human. The same page says those labels are currently in testing and appear under the profile name and handle. A personal or company account where a person writes and approves the content, and software only controls the publishing timestamp, is not an automated account under that definition. The test is authorship and accountability, not whether a cron job pressed the button.

By that test, a founder scheduling a week of build-in-public posts on Sunday night needs no label; a feed republishing an RSS source every hour should identify itself as automated. AI-drafted content sits on the same side of the line as long as you review it. X permits AI drafting; the disclosure requirement attaches to autonomous accounts, not to authors who used a model as a writing tool.

What is X's daily post limit in 2026?

About X limits, archived 12 June 2026, lists unverified accounts at 50 original posts and 200 replies per day, with those daily totals broken into smaller semi-hourly windows. The same page still lists 500 Direct Messages per day and a technical follow limit of 400 per day, plus the 5,000-follow ratio brake, and it still mentions a 2,400-update daily figure in the “what happens if I hit a limit” section.

PiunikaWeb (17 May 2026) compared Wayback captures and reported the change: as of 5 May 2026 the help page still said 2,400 posts per day for everyone; by mid-May it listed the 50 / 200 unverified caps. Heise and Business Standard carried the same Help Center numbers that week. If you run an unverified account and schedule 3 posts a day plus replies, you now have less headroom than the old 2,400 figure suggested, and a busy reply day can consume the 200-reply allowance on its own.

For realistic content schedules none of this binds a verified account. Sent2X Free allows 10 posts a month, Pro allows 500, and Max allows 750 — all sit inside even the unverified daily ceiling if you spread them across the month. The binding constraint on posting volume is audience patience, which is covered in the scheduling mistakes that suppress reach.

What does it cost to build your own compliant X automation?

Compliance means the official API, and the official API is no longer a free monthly bucket for new developers. Bundle.social (17 August 2026), verifying X's own pricing docs that day, lists pay-per-use as the default since February 2026: $0.015 per post created, $0.200 per post that contains a URL, and $0.005 per post read, with prepaid credits and a cap of 3 million post reads per billing cycle. A reply that is allowed because the author mentioned your app is listed separately as a summoned post at $0.010. Owned reads (your app reading its own data) were repriced to $0.001 on 20 April 2026. Legacy Basic ($200/month) and Pro ($5,000/month) remain only for accounts that already subscribed.

That 13.3x surcharge on link posts drives the entire calculation, because a founder posting for distribution puts links in a large share of posts. Assume a 40% link mix — a working assumption for a build-in-public account, not a published X statistic. The blended cost per post becomes (0.40 × $0.200) + (0.60 × $0.015) = $0.089 per post. Running that against Sent2X Pro at $39/month (500 posts, 150 AI replies/day) gives a break-even volume:

Two readings come out of this. Below roughly 200 posts a month, raw metered API access is cheaper than any subscription — if your build time and hosting are worth nothing. Above 438 posts a month at a 40% link mix, the metered fees alone exceed Sent2X Pro ($39, 500 posts, 150 AI replies/day). At 500 posts with links on every one, the API bill reaches $100 against that $39 plan. At Max volume (750 posts, $59/month, 400 AI replies/day) a 40% link mix costs $66.75 on the meter versus $59 managed.

The link surcharge is the variable to watch: at a 0% link mix, break-even versus Pro moves out to 2,600 posts a month ($39 ÷ $0.015). Price your own mix before deciding. The Free plan is $0 for 10 posts a month. Tool-by-tool subscription math across Buffer, Hootsuite and others is in the 2026 cost-per-post comparison.

What does a compliant X automation setup look like?

A setup that stays inside the April 2026 rules and the February 2026 API reply restriction has five properties. Check yours against them:

• OAuth, not passwords. Authorization happens on X's consent screen. No credentials stored anywhere else.
• Original content only. Each scheduled post is distinct — no recycled text loops, no cross-posting one message from several accounts, no automated trend-jacking.
• Zero automated engagement. No auto-like, auto-follow, or unattended keyword replies. A model may draft; a person approves every send. Self-serve API replies to strangers fail after 23 February 2026 anyway. AI reply bots that send alone need X's written approval first.
• Rate awareness. Posts spaced out rather than dumped in a burst, keeping clear of the semi-hourly windows on About X limits (50 original / 200 replies a day if unverified).
• Honest identity. Feed accounts labeled as automated; human accounts with scheduled human-approved content need no label. The automated label is still marked as in testing (25 June 2026 capture).

Every one of those is satisfied by a scheduler that authenticates through X OAuth and publishes on the API — which covers the mainstream tools and Sent2X alike. The methods for getting content into such a queue, from the native composer to CLI batch import, are compared in how to schedule and auto-publish posts to X in 2026. The rules are less restrictive than their reputation. They prohibit faking human attention, not saving your own time.

Frequently Asked Questions