Security · Posting

How VoiceMoat posts to Twitter and LinkedIn.

Every path is under your control. On Twitter, the extension renders drafts inline on x.com and you post via the native composer, or the dashboard schedules posts that fire at the time you set. On LinkedIn, main posts publish and schedule natively, and replies are drafted for you to paste. We never auto-post.

Twitter, two paths

How a post gets from VoiceMoat to Twitter.

Chrome extension. Manual post via native Twitter.

The extension renders audenAI drafts inline on x.com. You read the draft, edit if you want, and click Twitter's own Post button. The extension never calls the X API to publish. No tweet.write scope is exercised on this path.

Default for replies + on-the-feed posting.

Dashboard scheduling. Posts at the time you set.

You write a draft in the dashboard composer, hit Schedule, pick a time. At that exact time, a cron job posts it for you. This is the path that uses the tweet.write OAuth scope. You see every scheduled post in the calendar before it runs and can cancel or edit until the minute it fires.

Only when you click Schedule or Post Now on the dashboard.

LinkedIn, how it differs

How VoiceMoat posts to LinkedIn.

LinkedIn main posts. Native publish and schedule.

Write a draft in the dashboard, then publish it or schedule it to LinkedIn through LinkedIn's official API. Same rule as Twitter: nothing posts until you click. You see every scheduled LinkedIn post in the calendar and can cancel or edit before it fires.

When you click Schedule or Post Now for a LinkedIn account.

LinkedIn replies. Drafted for you to copy and paste.

LinkedIn has no public reply API, so VoiceMoat never posts a LinkedIn reply for you. It drafts the reply in your voice and you paste it into LinkedIn yourself. LinkedIn analytics are read through the Chrome extension using your own session, read-only.

Always manual. VoiceMoat never publishes a LinkedIn reply.

The OAuth question

Why we ask for tweet.write at sign-in.

The Twitter OAuth screen lists every scope a connecting app can ever exercise. tweet.writeappears on that list because the dashboard's Schedule and Post Now features use it. The scope is requested once, at sign-in. It only runs when you click Schedule or Post Now in the dashboard. It does not run in the background, on a timer, or while you sleep.

If you only want to use the Chrome extension and never touch dashboard scheduling, tweet.writesits unused. The extension posts through Twitter's native composer using your existing browser session. No VoiceMoat-initiated API call publishes anything in that flow.

Surface by surface

What actually calls Twitter and LinkedIn, and when.

Extension reply suggestions (Twitter)
Generated server-side, rendered inline on x.com. Posting happens through Twitter's native UI. No API call from us.
Dashboard composer, Post Now (Twitter)
Explicit button click. Posts immediately via the X API using your token. Result shows in your calendar within seconds.
Dashboard composer, Schedule (Twitter)
Saved to your calendar with the time you picked. Fires at that minute via our cron. Cancellable any time before it runs.
LinkedIn main posts (Post Now / Schedule)
Publish or schedule natively through LinkedIn's official API on your explicit click. Nothing fires without your approval.
LinkedIn replies
Drafted for you to copy and paste. LinkedIn has no public reply API, so VoiceMoat never posts a LinkedIn reply for you.
Voice training
Reads your recent public posts (Twitter via the X API, LinkedIn via the extension). Read-only. No write scope is used for training.
Analytics
Reads impression and engagement counters (Twitter via the X API, LinkedIn via the extension). Read-only.
The explicit no-list

What VoiceMoat never does with your accounts.

Auto-post without you clicking Post or Schedule. Every published post is a deliberate action you took.
Auto-DM, auto-follow, auto-unfollow, or any background account behaviour.
Reply to mentions, quote posts, or like posts on your behalf.
Inject content into anyone else's post or thread.
Touch your wallet, signatures, or any on-chain action. We don't connect to wallets at all.
Sell, share, or expose your access token to third parties.
Train shared models on your posts, drafts, or voice profile.
For the OAuth-averse

You can use VoiceMoat without granting tweet.write.

The Chrome extension renders audenAI drafts inline on x.com without exercising any write scope. It uses your already-signed-in Twitter browser session to render and to post through the native composer. If you only want reply drafts, on-feed suggestions, and voice-matched copy, the extension covers it.

You lose the dashboard scheduling features (Schedule, Post Now, the calendar queue, voice-based best-time slotting), which is the only place tweet.write actually runs. Everything else (voice training, analytics, draft generation, voice profile, brain customization) keeps working.

Voice training and analytics read your public posts (Twitter via the X API, LinkedIn via the extension). They never publish, follow, like, or engage on your behalf.

More security context

How we handle the rest of your data.