The pause is a setting, not a person

Twenty-three tools and a token#

Every hunting ground has a gate, and the interesting question is never how wide it opens but who is allowed to lean on it. X has now published documentation for a remote Model Context Protocol server sitting inside its own API gateway, and the address is plain enough: X's own developer documentation. The wording on that page is unambiguous about who may walk through. Any MCP-capable client, in the protocol's own terms, "can connect and immediately use 23 X Ads tools with zero custom Ads API integration".

Count the table on that page and the split is stark, and it is the shape of the whole x ads api story. Nine read tools, two analytics tools, two targeting-search tools, and ten writes. That last group is the one worth naming out loud, because a list of verbs is more honest than a total: create_campaign, update_campaign, activate_campaign, create_line_item, update_line_item, activate_line_item, add_targeting_criterion, remove_targeting, create_ad_post and promote_post. Four of those ten do not create anything at all. They change something that already exists.

This did not arrive out of nowhere. PPC Land's account of the launch puts the sequence plainly: Google shipped a read-only Ads MCP server in October 2025, Meta opened write access in April 2026, and the protocol specification itself was revised in July 2026, weeks before X shipped. The trail through the undergrowth was already trodden. What X has done is widen it and remove the fence.

So, what are x ads? They are the paid placements that run inside the X timeline, bought through the X Ads API interface most practitioners know, and now, additionally, through the x ads api, a machine interface most have never seen. The two do the same job. Only one of them has a human sitting in front of it, and only one of them sleeps.

Where the safety promise quietly stops#

To X's credit, the documentation leads with a guard rather than burying it. It states three separate times that writes are safe by default. The first: campaigns and line items are "always created PAUSED, and nothing spends money until it is explicitly activated". The second calls the arrangement "scoped and safe" and says "every write starts paused". The third repeats that campaigns and line items "are always created PAUSED".

Read those three sentences slowly and the same word does the work in all of them, and it is doing more work than the x ads api documentation admits. Created. Every statement of the guard is scoped to the creation path. The documentation says nothing whatsoever about update_campaign, update_line_item, add_targeting_criterion or remove_targeting acting on a campaign that is already running and already spending. That is not a gap somebody has to speculate about. It is a silence you can read on the page.

There is a second, sharper wrinkle. Both activate_campaign and activate_line_item sit inside that same ten-tool write set. The reassuring line reads "nothing spends until you explicitly activate", and the pronoun is carrying an enormous amount of weight. Activation is not a human checkpoint bolted onto the outside of the toolset. It is a tool inside it, callable by the same agent, in the same session, on the same token.

The claim that "every write starts paused" is also loose on its own terms. A write that removes a targeting criterion does not start paused; it simply happens. A write that activates a line item does not start paused either, since starting is the entire point of it. The guard is real and it is useful, but it covers the first step of a chain, and the chain has ten links.

Practitioners noticed within days. One marketing consultant framed the same asymmetry from the other side, noting that X now lets agents write live campaigns through a real interface in the same week Meta was banning tools that automate the browser instead, and that the difference between those two postures "isn't the AI. It's the plumbing." That is exactly right, and the plumbing is where the money is.

What the x ads api asks you to hold#

The authentication model is conventional OAuth 2.0, and the documentation is specific about it. Three scopes matter: ads.read grants the read and analytics tools, ads.write grants the campaign and creative writes, and offline.access enables token refresh. X is blunt about that third one, instructing developers to "always include it, or tokens expire in ~2 hours with no way to refresh".

Refresh tokens rotate on use, and the docs say to "always save the newest one". For anyone running the x ads api across several accounts, that is the detail that decides whether this is a toy or infrastructure. A two-hour access token with a rotating refresh key is a credential that dens down in your systems permanently, quietly renewing itself, long after whoever authorised it has forgotten the conversation.

Practitioners ask how much do x ads cost? and the honest answer has just gained a second half. The media cost is whatever the auction settles at. The governance cost is new, and it is the price of knowing which paw pulled which lever at three in the morning. Nobody quotes for that yet, which is precisely why it goes unbudgeted.

Scope is doing real work here too. The token bounds what the agent can see to what its holder can see, which is a genuine and sensible limit. It is also not a limit on intent, sequence or judgement. An agent holding ads.write on the x ads api has the account's full write surface, and the ordering of its calls is a matter of what the model decided to do next.

That distinction between scope and sequence is the whole quarry here. A permission model answers what an agent may touch. It says nothing about the order in which it touches things, and the x ads api is a set of ten write verbs that compose. Create, then activate, is two legal calls in a legal order that together end in spend.

What it changes for a licensed advertiser#

Follow the scent to where it actually leads. For a general retailer, an agent that reshuffles targeting overnight through the x ads api is an efficiency question and a slightly nervous morning. For a regulated advertiser it is a different animal entirely, because targeting is not a performance setting. It is a condition of being allowed to advertise at all.

Consider what sits inside add_targeting_criterion and remove_targeting for anyone working the awkward categories. Gambling advertisers operate under platform certification rules that tie an account to specific licensed territories. Age-gating, geographic restriction and audience exclusion are not optimisations for them; they are the terms of the permission. Strip one criterion and the campaign has not become less efficient. It has become non-compliant, and it is still running.

The same shape repeats across the verticals folkfox works in. A financial promotion carries jurisdictional limits. A health claim carries audience limits. the UK advertising code requires that advertising be socially responsible in ways that depend on who actually saw it, and X's own advertising policies bind the advertiser to the outcome, not to the tooling that produced it. No platform anywhere accepts "the agent did it" as a defence.

Anyone still running everything by hand through the x ads manager will read all this as somebody else's problem. It is not. The interface is not the control; the token is. An agent holding ads.write on the x ads api does not need to touch the manager to change what the manager displays tomorrow morning, and the x ads manager will show the change without a whisper about where it came from.

The governance gate the protocol does not ship#

None of this makes the x ads api a bad piece of engineering. It is a clean, well-documented server, and the paused-by-default default is more care than several platforms have shown. The Model Context Protocol specification does not define an approval step, an audit trail or a spend ceiling, because it is a transport, not a governance layer. Those belong to whoever connects it.

Which means the gate is yours to build, and building it is cheap compared with explaining an unlicensed impression to a regulator. Separate the read token from the write token on the x ads api. Keep ads.write out of any agent that also has a browser. Log every write call with the model, the prompt and the timestamp, because "we think it was the agent" is not an incident report, it is a shrug in the undergrowth.

Set a spend ceiling outside the platform, because the x ads api will not hold one for you. And write down, once, which of the ten write tools an agent is allowed to call unattended, because the honest answer for most licensed advertisers is a shorter list than ten and nobody has yet been asked to produce it.

Three moves ahead is the only place worth standing. The agents are prowling toward the ad account whether or not the governance arrives with them, and the platforms keep shipping the capability first and the controls later, exactly as they did with automated placements and automated creative. A fox does not argue with a gate. It notices which way the gate swings, and it gets there first. Build the gate before something wanders through it.

Frequently asked questions#