Verify X (Twitter) tasks on Galxe, Zealy and TaskOn

#How Galxe, Zealy and TaskOn verify X tasks

All three platforms check X tasks through the X account a participant connects, and each one rations those checks in its own way: Galxe with verification credits, Zealy with paid plans and claim credits, TaskOn with a fixed set of task types.

Before a quest goes live, the free Twitter Follow Checker shows whether one account follows another, in both directions, so you can test your own follow task by hand. The table compares what each platform does on its own.

• Native X tasks

  Galxe

  Follow, retweet, quote, post with keywords

  Zealy

  Follow, post, reply, retweet, like, quote, Space

  TaskOn

  Follow, retweet, like, quote with a hashtag or tags, post

• Is the action confirmed?

  Galxe

  Only with Authentic Verification on; by default a click counts

  Zealy

  Yes, from the connected account

  TaskOn

  Yes, from the connected account

• What X checks cost

  Galxe

  10 credits per check, from Rewards Hub Level 2 or Business+

  Zealy

  1 to 3 claim credits per action, paid plans only

  TaskOn

  Included in the Quest plan

• Custom route for your server

  Galxe

  REST credential

  Zealy

  API task

  TaskOn

  Completion-Based API Task

On Galxe, an X task is not confirmed by default. Every X credential starts with Authentic Verification switched off and uses the "Page Visit" method, which records that a participant opened the link, not that they followed or reposted (Galxe: Create Quest, Tasks Settings (opens in a new tab)). With Authentic Verification on, each follow, retweet or quote check spends 10 credits: Rewards Hub Level 2 gets 10K credits, Level 3 40K and Level 4 80K, and Galxe switches the check off once they run out (Galxe: X Authentic Verification Credits (opens in a new tab)). Likes can't be enabled for verification at all.

Zealy's X task checks five actions from the participant's connected account, and every action adds claim credits to the 1 credit each claim costs: a follow, post, quote or reply adds 1, a retweet 2 and a like 3 (Zealy: Twitter task (opens in a new tab)). X tasks come only with the paid plans, from $149 a month billed annually, and credits past a plan's monthly allowance cost $15 per 1,000 on Standard (Zealy pricing (opens in a new tab)).

TaskOn has seven X task types inside its Quest plan, $199 a month billed every six months. It has no reply or Community check, and its participant help asks anyone whose X check fails to wait 15 minutes and verify one task at a time.

#Verify X tasks on your own server with Sorsa API

To confirm X tasks on Galxe, Zealy or TaskOn without spending their credits, point the platform's custom API task at a small server of your own and let it ask Sorsa API, a Twitter (X) API and scraper: each task is one request that answers true or false, from $0.0014, with one API key and 20 requests per second on every plan.

The platform still owns sign-in. Zealy and TaskOn make participants connect their X account before the check runs, so the handle your server receives belongs to the person claiming. Your server answers each platform in its own format, keeps the Sorsa API key away from the platform, and runs the checks a platform lacks, such as a reply or a Community join.

Five quest tasks map to five Sorsa API checks, and each check passes on one field of its response.

• Follow an account

  Sorsa API request

  POST /check-follow (opens in a new tab)

  Passes when

  follow is true

• Retweet a post

  Sorsa API request

  POST /check-retweet (opens in a new tab)

  Passes when

  retweet is true

• Quote a post

  Sorsa API request

  POST /check-quoted (opens in a new tab)

  Passes when

  status is quoted

• Reply to a post

  Sorsa API request

  GET /check-comment (opens in a new tab)

  Passes when

  commented is true

• Join an X Community

  Sorsa API request

  POST /check-community-member (opens in a new tab)

  Passes when

  is_member is true

The official X API has no request that answers for one participant. Its route reads whole lists: your account's followers, 1,000 a page, at $0.001 per follower, and a post's retweeters at $0.010 per account, with 75 retweeter requests per 15 minutes (X API pricing (opens in a new tab), X API rate limits (opens in a new tab)). Lists don't fit inside a 5-second answer, so that route needs a sync job, a developer account and OAuth on top of the server.

#What each API task sends your server

Each platform sends the participant in a different shape and reads a different answer, so the server needs one small route per platform.

• Request

  Galxe REST credential

  GET or POST to your URL

  Zealy API task

  POST with a JSON body

  TaskOn Completion-Based API Task

  GET with ?address=

• The X user arrives as

  Galxe REST credential

  $socialId, placed in your URL

  Zealy API task

  accounts.twitter.id and .username

  TaskOn Completion-Based API Task

  the handle, never a numeric ID

• Your secret

  Galxe REST credential

  a header you add

  Zealy API task

  the X-Api-Key header

  TaskOn Completion-Based API Task

  Authorization: Bearer

• Pass

  Galxe REST credential

  your expression returns 1

  Zealy API task

  HTTP 200

  TaskOn Completion-Based API Task

  {"result": {"isValid": true}}

• Fail

  Galxe REST credential

  your expression returns 0

  Zealy API task

  HTTP 400 with a message

  TaskOn Completion-Based API Task

  isValid: false, still HTTP 200

• Time limit

  Galxe REST credential

  5 seconds

  Zealy API task

  10 seconds

  TaskOn Completion-Based API Task

  10 seconds, no retry

Galxe's documentation doesn't say whether $socialId carries an X handle or a numeric ID, so the server below accepts both: digits go to Sorsa API as user_id, anything else as username.

#Build the verification server in four steps

The server below answers all three platforms from one Node.js file, with one route per platform and one shared function that runs a quest's checks on Sorsa API side by side.

1. Get a key. Sign up and copy your API key from the dashboard. The first 100 requests are free and need no card.

2. Try one check. Ask whether a participant follows your project: username_1 is your account, username_2 the participant.

   curl -X POST "https://api.sorsa.io/v3/check-follow" \
     -H "ApiKey: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"username_1": "tidewell_protocol",
          "username_2": "nova_quest_hunter"}'
   

   {
     "follow": true,
     "user_protected": false
   }
   

3. Describe each quest. In QUESTS, give each quest a name and its X tasks: follow takes your handle, retweet, quote and reply take the post's link, and community takes the Community's ID.

4. Run the server. Save the file, set SORSA_API_KEY and a long random RELAY_SECRET, and start it with node verify-server.mjs behind HTTPS on ports 443 or 80.

   // verify-server.mjs: Node.js 18+, after `npm install express`
   import express from "express";
   
   const SORSA = "https://api.sorsa.io/v3";
   const KEY = process.env.SORSA_API_KEY || "YOUR_API_KEY";
   const SECRET = process.env.RELAY_SECRET; // the same value on each platform
   
   // The X tasks each quest requires; the URL path names the quest
   const QUESTS = {
     "launch-week": {
       follow: "tidewell_protocol",
       retweet: "https://x.com/tidewell_protocol/status/2116180244581376001",
     },
   };
   
   async function sorsa(method, path, data) {
     const url = new URL(SORSA + path);
     const init = { method, headers: { ApiKey: KEY },
       signal: AbortSignal.timeout(4000) };
     if (method === "GET") {
       url.search = new URLSearchParams(data);
     } else {
       init.headers["Content-Type"] = "application/json";
       init.body = JSON.stringify(data);
     }
     const res = await fetch(url, init);
     if (!res.ok) throw new Error(`Sorsa API ${res.status}`);
     return res.json();
   }
   
   // One check per task type, each resolving to true or false
   const CHECKS = {
     follow: async (account, u) => (await sorsa("POST", "/check-follow", {
       username_1: account,
       ...(u.user_id ? { user_id_2: u.user_id } : { username_2: u.username }),
     })).follow,
     retweet: async (post, u) => (await sorsa("POST", "/check-retweet",
       { tweet_link: post, ...u })).retweet,
     quote: async (post, u) => (await sorsa("POST", "/check-quoted",
       { tweet_link: post, ...u })).status === "quoted",
     reply: async (post, u) => (await sorsa("GET", "/check-comment",
       { tweet_link: post, ...u })).commented,
     community: async (id, u) => (await sorsa("POST",
       "/check-community-member", { community_id: id, ...u })).is_member,
   };
   
   // The tasks still missing; throws when a check couldn't run
   async function missing(questId, x) {
     const quest = QUESTS[questId];
     if (!quest || !x) throw new Error("unknown quest or user");
     const u = /^\d+$/.test(x) ? { user_id: x }
       : { username: x.replace(/^@/, "") };
     const tasks = Object.entries(quest);
     const done = await Promise.all(tasks.map(([t, v]) => CHECKS[t](v, u)));
     return tasks.filter((_, i) => !done[i]).map(([t]) => t);
   }
   
   const app = express();
   app.use(express.json());
   
   // Galxe REST credential: GET /galxe/<quest>?user=$socialId
   const GALXE = {
     "Access-Control-Allow-Origin": "https://dashboard.galxe.com",
     "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type, X-Relay-Secret",
   };
   app.options("/galxe/:quest", (req, res) => res.set(GALXE).sendStatus(204));
   app.get("/galxe/:quest", async (req, res) => {
     res.set(GALXE);
     if (req.get("X-Relay-Secret") !== SECRET) return res.status(401).end();
     try {
       const left = await missing(req.params.quest, String(req.query.user));
       res.json({ eligible: left.length ? 0 : 1, missing: left });
     } catch {
       res.json({ eligible: 0, missing: ["not checked, try again"] });
     }
   });
   
   // Zealy API task: POST /zealy/<quest>, the secret arrives as X-Api-Key
   app.post("/zealy/:quest", async (req, res) => {
     if (req.get("X-Api-Key") !== SECRET) {
       return res.status(400).json({ message: "Invalid API key" });
     }
     const x = req.body.accounts?.twitter;
     try {
       const left = await missing(req.params.quest, x?.id || x?.username);
       if (!left.length) return res.json({ message: "X tasks verified" });
       res.status(400).json({ message: `Not done yet: ${left.join(", ")}` });
     } catch {
       res.status(400).json({ message: "Couldn't check now, retry in a minute" });
     }
   });
   
   // TaskOn Completion-Based API Task: GET /taskon/<quest>?address=<handle>
   app.get("/taskon/:quest", async (req, res) => {
     if (req.get("Authorization") !== `Bearer ${SECRET}`) {
       return res.status(401).json({ result: { isValid: false } });
     }
     let isValid = false;
     try {
       const left = await missing(req.params.quest, String(req.query.address));
       isValid = left.length === 0;
     } catch {} // TaskOn reads anything but HTTP 200 as a broken endpoint
     res.json({ result: { isValid } });
   });
   
   app.listen(process.env.PORT || 3000);
   

A quest costs one request per task per claim, and the checks for one claim run at the same time, so five tasks take about as long to answer as one. Each call to Sorsa API stops after 4 seconds, inside Galxe's 5-second window.

The server keeps two answers apart. A check that comes back false fails the claim and names the missing task. A timeout, a 429 or a 403 from Sorsa API means the server couldn't check, and the participant is asked to try again instead of being told they failed: a 403 means the key is missing or out of requests, a 429 means more than 20 requests landed in one second. Failed requests are never charged.

Good to know

POST /check-retweet scans a post's newest 100 retweets per request. A participant who presses Verify right after retweeting is in that window; on a post with thousands of retweets, someone who retweeted days earlier is not. Ask participants to verify right after they retweet, or follow next_cursor in a background job, as the guide to the Twitter verification API shows.

#Connect Galxe with a REST credential

On Galxe, the server goes in as a REST credential: Galxe calls your URL when a participant presses Verify, runs your expression on the JSON that comes back, and marks the task done when the expression returns 1.

1. Open the credential. In the quest's Task Settings, choose Import Your Own Data, then REST, the GET method and Single Dimension.

2. Pick the ID type. Choose the participant's X account, so Galxe fills $socialId with it.

3. Enter the endpoint. Use https://verify.example.com/galxe/launch-week?user=$socialId and add the header X-Relay-Secret with your secret; Galxe shows headers only to Space admins.

4. Paste the expression. It must return the number 1 or 0, never true or false.

   function(resp) {
     return resp && resp.eligible === 1 ? 1 : 0;
   }
   

5. Test and save. Send one account that did the tasks and one that didn't, and check both answers.

Galxe cancels any request that takes longer than 5 seconds, accepts only ports 443 and 80, and sends a CORS preflight when you save the credential, which the server's OPTIONS route answers. Requests come from Galxe's servers at 35.185.209.0 and 35.203.155.18, so allow those two addresses if a firewall sits in front of the server (Galxe Docs: REST credential (opens in a new tab)). The expression itself is public, so keep secrets out of it.

#Connect Zealy with an API task

On Zealy, the server becomes an API task: Zealy sends a POST with the participant's X ID and username, a 200 response completes the claim, and a 400 response shows your message to the participant.

1. Add the task. In the quest editor, choose Add task, then Api.

2. Set the endpoint and key. Enter https://verify.example.com/zealy/launch-week and your secret as the API key; Zealy sends it in the X-Api-Key header.

3. Choose Twitter to identify users. Zealy then puts accounts.twitter.id and accounts.twitter.username into every request.

4. Save. Zealy tests the endpoint first: it has to answer within 10 seconds, with HTTP 200 or 400 only.

To see what Zealy will see, send the same request yourself with a test account:

curl -X POST "https://verify.example.com/zealy/launch-week" \
  -H "X-Api-Key: YOUR_RELAY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"requestId": "test-1", "accounts": {"twitter":
       {"id": "1849021166738190336", "username": "nova_quest_hunter"}}}'

{
  "message": "Not done yet: retweet"
}

Zealy shows that message to the participant together with the claim's requestId, so they learn which task is missing and you can find the claim in your logs (Zealy: API task (opens in a new tab)). An API task isn't one of Zealy's X tasks, so it adds no X credits: a quest built this way spends the 1 base claim credit per claim, where a native follow and retweet spend 4.

#Connect TaskOn's Completion-Based API Task

On TaskOn, the server is a Completion-Based API Task: TaskOn sends a GET with the participant's X handle in address, and the server always answers HTTP 200 with isValid set to true or false.

1. Add the task. In the campaign or quest, add a task, open the Custom API tab and choose Completion-Based API Task.

2. Set the API URL. Click Set API URL, choose Social Media Account and then X handle, and enter https://verify.example.com/taskon/launch-week.

3. Lock it to TaskOn. Turn on Restrict API access exclusively to TaskOn and enter your secret as the Bearer token.

4. Test and confirm. Enter one account that completed the tasks and one that didn't, click Verify on each, and Confirm once both answers are right.

TaskOn makes one attempt per click and never retries, and it treats any status other than 200, or a missing result, as a broken endpoint (TaskOn: Completion-Based API Task (opens in a new tab)). That is why the server answers isValid: false when Sorsa API couldn't be reached: the participant presses Verify again a minute later, and the next check runs fresh.

#What a verified claim costs on each route

A claim that needs a follow and a retweet spends 20 Galxe credits with Authentic Verification, 4 Zealy claim credits with native X tasks, or 2 Sorsa API requests, from $0.0028, behind an API task.

Only the Sorsa API route grows with your own plan instead of the platform's credit allowance, as the table shows for one follow-and-retweet claim.

• Sorsa API behind an API task

  One follow and retweet claim spends

  2 requests, from $0.0028

  What that allows

  as many claims as your plan's requests

• Zealy, native X tasks

  One follow and retweet claim spends

  4 claim credits, $0.06 at $15 per 1,000

  What that allows

  2,500 claims on Standard's 10K monthly credits

• Zealy with an API task

  One follow and retweet claim spends

  1 claim credit plus the 2 requests

  What that allows

  10K claims on the same 10K credits

• Galxe, Authentic Verification

  One follow and retweet claim spends

  20 X verification credits

  What that allows

  500 claims on Level 2, 4,000 on Level 4

• Official X API behind an API task

  One follow and retweet claim spends

  list reads: $0.001 per follower of yours, $0.010 per retweeter

  What that allows

  a developer account, OAuth and a sync job

Sorsa API bills requests, not participants, and failed requests are never charged. The rate per 1,000 requests runs from $4.90 on Starter to $1.40 on the largest plan.

#Keep bots and unfollowers out of the reward list

A verified task proves one action, not one person, so three more checks belong before rewards go out: account age, a public account and a follow that is still there.

• Account age and size. GET /info (opens in a new tab) returns a participant's created_at, followers_count and tweets_count in one request, so the server can turn away accounts younger than 30 days or with no posts. Galxe has age and follower limits of its own; on Zealy and TaskOn the server is the place for them.
• Public accounts. The follow, retweet and quote checks return user_protected: true when a participant's account is private, and no outside check can see what a private account does. Ask the participant to make it public for the quest.
• Unfollows after the claim. Galxe's own help notes that some participants follow to claim and unfollow afterwards. Run POST /check-follow once more on the reward list before you pay out.
• Likes. X made likes private in June 2024, so only the participant's own connected account can show a like, and Sorsa API returns none (Engadget (opens in a new tab)). Ask for a retweet, quote or reply instead: all three stay public and checkable.

For scoring a whole list of participants, Twitter bot detection covers the signals that separate real accounts from farms. Community tasks and the Community's member list are covered in the X Lists and Communities API guide.

#Run your next quest with verified X tasks

To verify X follows, retweets, quotes, replies and Community joins on Galxe, Zealy or TaskOn, use Sorsa API behind the platform's API task: one request per task, from $0.0014 per check, 20 requests per second on every plan, and no developer account or X login of yours anywhere in the flow. Take the 100 free requests, run the server against a test quest with two accounts, one that did the tasks and one that didn't, and move the quest's X tasks to the API task before launch.

#FAQ