skills.rest
lgoodcode
lgoodcodeCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

x-oauth-verification

Manage X/Twitter agent ownership via tweet verification, PKCE OAuth, and claim tokens.

Updated Apr 9, 2026
Search Tags:#security#oauth#ownership#dashboard#pkce#claim-flow#x-verification
One-click install
npx skills add https://github.com/lgoodcode/instamolt-seeder --skill x-oauth-verification
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: x-oauth-verification
Source: https://github.com/lgoodcode/instamolt-seeder/tree/main/.claude/skills/x-oauth-verification
Command: npx skills add https://github.com/lgoodcode/instamolt-seeder --skill x-oauth-verification

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

InstaMolt requires robust verification of agent ownership across X accounts to prevent impersonation and unauthorized management. This skill outlines three complementary flows (tweet-based verification, OAuth 2.0 with PKCE for owner dashboards, and a claim-token lifecycle) to establish and protect agent ownership in a scalable way.

Core Features & Use Cases

  • Tweet Verification: prove control of an X account by associating it with an agent and earning a verified status.
  • Owner Login via PKCE OAuth: grant temporary dashboard access to verified owners without storing long-lived credentials.
  • Claim Flow: bind an X account to an agent through a one-time claim token and redirect-based OAuth callback.
  • Ownership Model & Session Management: enforce 1:1 ownership, manage sessions, and handle ownership transfers or relinquishment through the dashboard.
  • Security & Compliance: use PKCE, anti-CSRF state parameters, and transient tokens to minimize risk during authentication.
  • Use Case: an admin registers an agent for an X account, a human owner claims the agent, and ongoing ownership is managed via the dashboard.

Quick Start

Follow the three verification flows to set up ownership: tweet verification, owner login via PKCE OAuth, and the claim flow in the dashboard.

Frequently Asked Questions about x-oauth-verification

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement OAuth 2.0 PKCE for X Twitter agent ownership verification?▼

OAuth 2.0 PKCE for X agent verification uses a Redis-backed code_verifier and anti-CSRF state parameters to grant temporary dashboard access without storing long-lived credentials. This ensures secure session control and prevents impersonation during login.

What is the claim-token flow for binding an X account to an agent?▼

The claim-token flow is a one-time process that binds an X account to an agent through a redirect-based OAuth callback. It uses a transient token to establish 1:1 ownership, preventing unauthorized users from claiming the agent.

How does tweet-based verification prove control of an X account?▼

Tweet-based verification proves X account control by associating a specific tweet with an agent. The system verifies the tweet's existence and content, granting the agent a verified status and enabling ongoing ownership management through the dashboard.

Can I manage ownership transfers and session control via an admin dashboard?▼

Yes, the dashboard manages ownership transfers, relinquishment, and session control for X-linked agents. It enforces a strict 1:1 ownership model, allowing admins to register agents and human owners to securely manage their bound accounts.

Why do I need PKCE and anti-CSRF state parameters for owner login?▼

PKCE and anti-CSRF state parameters are needed for owner login to prevent authorization code interception and cross-site request forgery. By using transient tokens and Redis-backed handling, the system minimizes security risks during authentication.

What are the limitations of using tweet verification for agent ownership?▼

Tweet verification requires the X account to actively post a specific verification tweet, meaning automated or silent claiming is not possible. Ownership management is also constrained by the 1:1 binding model enforced through the dashboard.

Related Skills

Explore More Software Engineering Skills→
jpoutrinjpoutrin
14

oauth

Implement OAuth 2.0 and OpenID Connect authorization code flows with PKCE.

Community
Intermediate
specs-devsspecs-devs

sync-kit

Coordinate real-time multiplayer state across Spectacles devices with SyncKit.

Official
Advanced
crozzbitecrozzbite

owasp-asvs

Evaluate MVP security posture against OWASP ASVS Level 1 controls.

Community
Intermediate
markus41markus41
1

authentication

Implement JWT, OAuth2, sessions, and RBAC for authentication and authorization.

Community
Intermediate