X automation in 2026: what actually works

Two approaches, and the choice is mostly made for you by what you are trying to do. The official API is stable, documented and cannot do most of what multi account operators need. Browser automation can do nearly all of it and breaks more often.

The official API

X sells API access in tiers. The free tier permits a small number of posts a month and little else. The paid developer tiers move into the hundreds of dollars a month, and enterprise pricing is a conversation rather than a number. Check current pricing directly, because these tiers have been repriced repeatedly since 2023 and any figure written down here will age badly.

What matters more than the price is the shape of the limits. Tiers are scoped per project, not per account, so the cost does not divide neatly across twenty accounts. Several things operators want are either absent or restricted: reading the home timeline the way a user sees it, following at any volume, and most direct message functionality.

The API is the right answer for a single branded account with a publishing workflow, for analytics, and for anything where stability matters more than reach. It is not the answer for running many accounts.

Browser automation

The alternative is to drive a real browser: open the site, find the button, click it, type in the box. Anything a person can do is reachable, because it is the same interface.

The cost is fragility. The automation depends on locating elements in a page that X changes whenever it likes. A renamed attribute breaks the step that used it, silently, and the first sign is usually a task that reports success while nothing happened.

Where the browser runs decides everything else

Once you have chosen browser automation, one question determines how much else you have to worry about: whose computer opens the browser.

If it runs on a provider's servers, your accounts log in from that provider's address space, shared with every other customer. The convenience is real, since nothing needs to stay switched on at your end. The cost is that you have joined a pool whose behaviour you cannot see and cannot influence.

If it runs on your own machine through your own proxies, the addresses are yours and the reputation is yours. The cost is that the machine has to be on.

flottra is built the second way, and the trade is deliberate. The panel holds the schedule, a desktop app on your computer opens a real browser per account through your proxy, and the connection runs outbound only, so nothing listens for inbound traffic and no ports are opened. Pairing is an eight character code, valid for ten minutes, typed once. The setup. If your laptop sleeps, that machine's jobs wait and are rescheduled rather than firing all at once on wake.

Automation does not change the limits

The tool decides what is possible, not what is safe. The pacing that keeps accounts alive is the same whether a person or a script is doing the clicking, and it is the part people skip because automation makes speed feel free.

As a starting point, the hourly ceilings flottra ships with are 12 likes, 10 follows, 5 replies, 3 posts and 3 direct messages. Posts land on a randomised interval of two to four hours inside a daytime window, which works out at roughly four to six a day. Queued tasks for one account are separated by a randomly chosen gap between thirty seconds and three minutes, so the rhythm is uneven rather than metronomic.

Two refinements matter more than the raw numbers. Actions should not be evenly spaced, since a fixed interval is a signature. And accounts should not all act at the same moment, because thirty accounts firing together is a pattern even when each one is individually reasonable.

The part automation is worst at

Automating the clicking is solved. Automating what to say is not.

The failure is recognisable from outside: thirty accounts that post competent, interchangeable sentences on the same topics at similar times. Each account looks fine alone. Together they are obviously one operation, and the duplicate content rule is the one X enforces most readily against account groups.

What helps is giving each account a genuinely different remit: its own topics, its own opinions, its own register, its own posting rhythm. flottra calls this a persona and attaches one per account. How that works. It reduces the problem. It does not eliminate it, and anyone who tells you their generator produces thirty distinguishable voices indefinitely is overselling.

The accounts that do best are the ones where a person still writes the posts that matter and automation handles the repetitive remainder: the scheduling, the warming, the follows, the routine replies.

Choosing a tool

1. Ask where the browser runs. If the answer is their servers, your accounts share an address space with strangers.
2. Ask whether you supply the proxies. A vendor selling both the automation and the addresses has a reason to tell you the addresses are fine.
3. Ask what happens when X redesigns. Any honest answer includes the word break. The useful follow up is how quickly fixes reach you.
4. Ask how credentials are stored. Encrypted at rest is the minimum. Ask who holds the key, and treat a vague answer as a no.
5. Distrust survival guarantees. Nobody controls X's enforcement. A vendor promising no bans is telling you something they cannot know.

On the fourth point, the honest version of our own answer: credentials are encrypted before storage and decrypted only to be sent to your machine, sealed to that device's own key so only it can open them. But we hold the storage key today, so this protects you if our database leaks, not from us. Keys only you hold are the next thing being built. The rest of the awkward questions.

For the layers underneath the tool, see choosing proxies for X accounts, whether you need an antidetect browser and why X accounts get suspended.