X (Twitter)

Account Activity webhook signed with X-Twitter-Webhooks-Signature (HMAC-SHA256 of the body, base64, sha256= prefix). HMAC fail-closes without consumer_secret.

CRC is a GET on the same HTTP front: crc_token → JSON {"response_token": "sha256=<hmac>"}. handle() never sees that GET.

export X_BEARER_TOKEN='…'
export X_CONSUMER_SECRET='…'
export PORT=8080

cx.channels.add(
    "x",
    via="self-host",
    bearer_token=bearer_token,
    consumer_secret=consumer_secret,
    bot_token="local",
)
# POST -> cx.handle("x", body, headers)
# GET crc_token on the same HTTP front (not handle())

await cx.channels.add("x", {
  via: "self-host",
  bearer_token,
  consumer_secret,
  bot_token: "local",
})
// POST → await cx.handle("x", body, headers)
// GET crc_token on the same HTTP front (not handle())

What it can do

Plans Post and Reply (tweets and DMs). Capabilities: receive, send, reply, dm.