App-only actions

Some changes can’t be undone or would cost money or access if a model got them wrong. They are only possible in the Xholic app, by you:

• Billing: changing or cancelling a plan, buying credits, payment methods
• X accounts: connecting, reconnecting or removing an X account
• Sharing and roles: inviting people, changing or removing their access
• Sessions and security: signing out devices, API keys and connected apps

Most of these can still be read: billing.status, billing.details, billing.payments, billing.credit_packs and sharing.list are ordinary read actions, so your AI can answer “when does my plan renew?” or “who has access to my account?”.

There is simply no action for these changes, so no API key or connected app can make them, whatever a model is told. API keys and connected apps themselves are managed in Settings → API / MCP / CLI.

Also not exposed

Things that only make sense inside the app’s own screens: tours, onboarding steps, the paywall, browser-extension lifecycle, and Ask Xholic’s chat-only tools (presenting drafts and choices in the chat UI).