# X says 'Sensitive permissions requested': is it safe to connect a scheduler? > The new X warning means an app wants to post for you & X hasn't vouched for it. It's safe if you check the app, callback URL & permissions first. - Published: 2026-10-14 - Last updated: 2026-10-14 - Author: Sanju (Founder & CEO @ DunSocial) - Topics: x, how-to --- The "Sensitive permissions requested" screen means the app you are connecting wants to post as you, & X is asking you to confirm that you trust it. It is not an error & it is not a sign your account was hacked. It is safe to continue only if you started from an app you chose yourself, the permissions match what the tool does, & the callback address matches its website. ## What the new X screen says Since September 14, 2026, X shows extra text when an app asks to write to your account. X told developers the change is meant to protect people from phishing & impersonation, per [X's developer announcement](https://devcommunity.x.com/c/announcements/22) about the OAuth consent screen. The screen adds four things: - A "Sensitive permissions requested" notice. - A statement that the app is not affiliated with X. - A reminder to confirm you trust the callback URL. - An "I trust this app" checkbox you must tick before Authorize works. It applies to pay-per-use apps that request any write permission or access to read your direct messages. App developers cannot switch it off. ## Why a scheduler triggers it A scheduler publishes while you are away. Posting needs a write permission, so connecting any posting tool to X can show this screen. That is why seeing it does not tell you whether a tool is good or bad. It tells you the app is asking for the power to post. ## What to check before you tick the box 1. **Did you start the connection yourself?** Only authorize an app you opened on purpose. Researchers have documented [OAuth consent phishing on X](https://radar.securityalliance.org/2025-10-twitter-x-phishing/), where a fake email sends you straight to a real X authorization page for a malicious app. 2. **Do the permissions fit the job?** A scheduler needs to post & upload media. A scheduler that also wants to read your messages should make you stop. 3. **Does the callback URL match the tool's website?** After you approve, X sends your approval to that address. If the domain looks misspelled or unrelated to where you started, cancel. 4. **Is the name familiar?** A logo & a trustworthy name are easy to copy. Judge the website you came from, not the label on the screen. X's own developer docs recommend that apps ask for [only the permissions they need](https://docs.x.com/fundamentals/developer-apps), which is the same standard you should hold a tool to. ## What a scheduler never needs A scheduler never needs your X password. You approve an app on x.com & X hands the app a token, so you only ever type your password into x.com itself. If a tool asks for your X username & password in its own form, do not use it. ## How to revoke access later Open X → Settings → Security and account access → Apps and sessions → Connected apps, find the tool, & revoke it. The token stops working straight away. If you revoke an app by mistake, scheduled posts will fail until you reconnect. The fix is in [why does my X scheduler keep asking me to reconnect](/blog/why-does-my-x-scheduler-keep-asking-me-to-reconnect), & the broader checklist is in [why did my scheduled social post fail](/blog/why-did-my-scheduled-social-post-fail). ## How DunSocial connects to X DunSocial connects through X's standard OAuth 2.0 sign-in, so your password never reaches it. The connection is set up to post & upload media, not to read your direct messages. Tokens are encrypted before they are stored & refreshed on a schedule so the connection stays alive. Because posting needs a write permission, you may see X's "Sensitive permissions requested" notice when you connect. Check that the callback address belongs to DunSocial before you tick the box. For the rules scheduled posting has to follow on X, read [is scheduling posts on X against the rules](/blog/is-scheduling-posts-on-x-against-the-rules). To plan a thread, see [how to schedule a thread on X](/blog/how-to-schedule-a-thread-on-x). ## Connect X to DunSocial $20/mo flat, or $192/yr, with a 14-day trial & every feature unlocked from day one. Connect X, schedule next to your other networks, & confirm each post before it goes out. [Start the trial](https://app.dunsocial.com/login). ## FAQ ### What does "Sensitive permissions requested" mean on X? It means the app wants a write permission, such as posting, or access to your direct messages. X adds the notice, a "not affiliated with X" line & a required checkbox so you confirm the decision yourself. ### Is the "I trust this app" checkbox safe to tick? Tick it only for an app you opened on purpose, whose permissions fit its job & whose callback address matches its website. If any of those is unclear, cancel. Nothing is granted until you authorize. ### Can the app developer remove the warning? No. X told developers it is expected behavior for pay-per-use apps that request write access or message access. It is not a bug, & it does not mean the app is misconfigured. ### Does the warning mean my account was hacked? No. It appears on the authorization screen before any access is granted. If you did not start a connection yourself, close the page & check Connected apps in X settings. ### How do I disconnect a scheduler from X? Go to X → Settings → Security and account access → Apps and sessions → Connected apps & revoke the tool. Scheduled posts stop publishing until you reconnect it. ## Sources - [OAuth consent screen update for apps requesting sensitive scopes (X Developer Community announcements, 2026-09-14)](https://devcommunity.x.com/c/announcements/22) - [X developer apps & permissions (X docs)](https://docs.x.com/fundamentals/developer-apps) - [X (Twitter) phishing account takeovers (SEAL Intel, Security Alliance)](https://radar.securityalliance.org/2025-10-twitter-x-phishing/) --- ## About this document This is the Markdown representation of https://www.dunsocial.com/blog/x-sensitive-permissions-requested-is-it-safe-to-connect-a-scheduler. The HTML version of the same page is at the same URL. You can also request Markdown from any page by sending `Accept: text/markdown`. Machine-readable summary of the whole site: https://www.dunsocial.com/llms.txt ## Company - Product: DunSocial, https://www.dunsocial.com - Legal entity: THISUX PRIVATE LIMITED, Chennai, Tamil Nadu, India - Support: support@dunsocial.com - Open the app: https://app.dunsocial.com/login