WP Manifestindependent plugin directory
manifest / integrations / burrowsync-for-x

BurrowSync for X – Two-Way WordPress Sync

BurrowSync for X: two-way sync between WordPress notes and one X account via the official X API. Part of the BurrowSync family.

by Daniel Wonder · github.com/danieljwonder/burrowsync-for-x · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/danieljwonder/burrowsync-for-x/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/danieljwonder/burrowsync-for-x ↗

Beta. Pre-1.0. It runs in production, but test it on a staging site before relying on it.

Two-way synchronization between the WordPress note post type and one X account through the official X API.

Behavior

  • X → WordPress uses a signed X Filtered Stream webhook. Complete post text, original timestamps, expanded links, and photos are retained.
  • WordPress → X publishes new notes with the first attached image.
  • Standard publishing uses X's 280 weighted-character limit. An explicit X Premium setting allows posts up to 25,000 characters.
  • A one-off recent-post import provides initial backfill and manual recovery. There is no scheduled polling fallback.
  • X-origin notes never echo back to X. Post IDs deduplicate webhook redelivery, manual imports, and outbound echoes.
  • Companion Farcaster and Nostr plugins are supported through the shared note post type and origin metadata, but are not dependencies.

Inbound t.co URLs are replaced using unwound_url when X provides it, then expanded_url as the fallback. Media-only wrappers are removed because attached photos are handled separately.

Requirements

  • WordPress 5.9+, PHP 7.4+, and a public HTTPS site
  • X pay-per-use API access
  • OAuth 2.0 Client ID and Client Secret
  • App Bearer Token for webhook management
  • API Secret Key for CRC and event-signature verification

The settings screen displays the exact OAuth callback and webhook URLs and walks through connection, Filtered Stream linking, and sync behavior.

Architecture

burrowsync-for-x.php              bootstrap and note CPT registration
includes/
  class-bsync-x-settings.php     encrypted settings and secrets
  class-bsync-x-oauth.php        OAuth 2.0 PKCE and token rotation
  class-bsync-x-client.php       X REST client and media upload
  class-bsync-x-webhook.php      registration, CRC/signature checks, event queue
  class-bsync-x-inbound.php      X post to WordPress note mapping
  class-bsync-x-publisher.php    note publishing, limits, retries, reconciliation
  class-bsync-x-cron.php         manual recent import and token health check
admin/                           settings, note status column, retry controls
tests/                           standalone PHP regression tests

Secrets are encrypted with sodium crypto_secretbox using a key derived from the WordPress authentication salts. This protects database-only leaks, not a compromised host.

Tests

sh tests/run-tests.sh

The test suite covers OAuth PKCE and rotation, webhook HMAC verification and payload normalization, anti-echo ordering, deduplication, Premium and standard length handling, link expansion, media mapping, retries, reconciliation, and encrypted secret storage. It requires only CLI PHP and makes no network calls.

License

GPLv2 or later.

BurrowSync is independent and is not affiliated with or endorsed by X Corp.