Credentials

FxEmbed needs X/Twitter account credentials to fetch post data from the Twitter API. These credentials are encrypted and stored securely.

Credential Format

Credentials are defined in a credentials.json file:

{
  "twitter": {
    "accounts": [
      {
        "authToken": "your_auth_token",
        "csrfToken": "your_ct0_csrf",
        "username": "account_screen_name"
      }
    ]
  }
}

You can include multiple accounts in the accounts array. FxEmbed will use them to distribute requests.

Obtaining Tokens

The authToken and csrfToken values come from an authenticated X/Twitter session. You can extract them from your browser’s cookies:

• authToken: The auth_token cookie
• csrfToken: The ct0 cookie

Credential Management Scripts

FxEmbed includes tooling to encrypt, push, and pull credentials:

Encrypt Credentials

Encrypt your credentials.json using your CREDENTIAL_KEY:

npm run credentials:encrypt

Push to R2

Upload encrypted credentials to Cloudflare R2 storage:

npm run credentials:push

Encrypt and Push

Combined encrypt + push in one step:

npm run credentials:encrypt-push

Pull from R2

Download and decrypt credentials from R2:

npm run credentials:pull

Add CSRF Tokens

Refresh CSRF tokens for existing credentials:

npm run credentials:add-csrf

Strip Credentials

Remove sensitive data from the credentials file:

npm run credentials:strip

Setting the Credential Key

The encryption key must be set as a Wrangler secret so the deployed worker can decrypt credentials at runtime:

wrangler secret put CREDENTIAL_KEY

Bluesky

FxEmbed by default will use the public Bluesky AppView API. We support specifying fallback accounts on different PDSes in the event of downtime of the public API. We will always prefer the public API unless it is down.

The proxy uses standard Bluesky app passwords — no OAuth flow, no DPoP, nothing exotic.

Credential Format

Bluesky accounts live alongside Twitter accounts in the same credentials.json:

{
  "bluesky": {
    "accounts": [
      {
        "identifier": "your.handle.bsky.social",
        "appPassword": "xxxx-xxxx-xxxx-xxxx",
        "service": "https://bsky.social"
      }
    ]
  }
}

Fields:

• identifier: The account’s handle (e.g. your.handle.bsky.social) or DID.
• appPassword: An app password generated at bsky.app/settings/app-passwords. Do not use the account’s main password.
• service: The base URL of the account’s PDS. For accounts hosted on Bluesky’s infrastructure, use https://bsky.social (the entryway will route to the correct *.host.bsky.network PDS automatically). For self-hosted or third-party PDSes, set this to the actual PDS URL (e.g. https://pds.example.com).

Generating an App Password

1. Sign in to the account you want to use as a proxy.
2. Open Settings → Privacy and security → App passwords (or visit bsky.app/settings/app-passwords directly).
3. Click Add App Password, give it a descriptive name (e.g. FxEmbed Proxy), and copy the generated xxxx-xxxx-xxxx-xxxx value.
4. Paste it into the appPassword field above.

App passwords can be revoked at any time from the same screen if a key is ever compromised.

Encryption and Deployment

Bluesky credentials are encrypted, pushed, and pulled using the exact same credential management scripts and CREDENTIAL_KEY as Twitter — there’s nothing Bluesky-specific to configure on the worker side.