# Security Notes

## Credentials

`APIDANCE_API_KEY` is required and is sent to Apidance as the `apikey` header.

`APIDANCE_AUTH_TOKEN` is optional. It is the value of your Twitter/X cookie named `auth_token` and is sent as the `AuthToken` header. Use it only for operations that need your own account, such as posting, retweeting, liking, bookmarking, home timeline, notifications, or other authenticated account flows.

Do not commit real keys or cookie values to this repository.

## Redaction

The server redacts the configured API key, auth token, and proxy value from the returned request URL. This matters for `remaining_calls`, because the API key appears in `/key/{apikey}`.

MCP clients may still log tool inputs. Prefer environment variables over per-call `api_key` and `auth_token` arguments when possible.

## Network Scope

By default, the server only sends requests to:

```text
https://api.apidance.pro
```

The API base URL is fixed in the server implementation, so credential-bearing requests are not redirected by runtime configuration.

## Proxy Header

`APIDANCE_USE_PROXY` is forwarded as the Apidance `UseProxy` header. If the proxy string includes credentials, store it like a secret.

## Account Actions

Tools that create or mutate Twitter/X state should be considered high-impact:

- `twitter_graphql_create_tweet`
- `twitter_graphql_create_note_tweet`
- `twitter_graphql_create_retweet`
- `twitter_graphql_quote_tweet`
- `twitter_graphql_favorite_tweet`
- `twitter_graphql_create_bookmark`
- `twitter_upload_media`

Configure your MCP client approval rules so these tools require confirmation if your workflow needs a safety gate.