The X API, formerly the Twitter API, lets software read and publish on X: search posts, post and reply, look up users, send DMs, manage lists and read trends. You get access by signing in at console.x.com with your X account, accepting the Developer Agreement, creating an app and saving the keys it generates. Billing is pay-per-use: you buy credits and each request uses them.
If you last looked at the Twitter API when it had a free tier and fixed monthly plans, a lot has changed. X's own docs now describe a credit-based model with no subscriptions, and the developer portal has become the Developer Console. Here's how it fits together.
What you can do with the X API
| Area | What X says you can do |
|---|---|
| Posts | Search, retrieve, create and delete posts; access timelines, threads and quote posts |
| Users | Look up profiles, manage follows, blocks and mutes, access follower data |
| Direct Messages | Send and receive private messages |
| Lists | Create and manage curated lists of accounts |
| Spaces | Find live audio conversations and their participants |
| Trends | Access trending topics by location |
Two features stand out in X's documentation. The filtered stream delivers posts in near real time as they're published, with up to 1,000 filtering rules. Full-archive search covers the complete history of public posts back to 2006.
How to get X API access, step by step
X's getting started guide breaks it into three steps:
- Create a developer account. Go to console.x.com, sign in with your X account, accept the Developer Agreement and Policy, and add basic information about how you'll use the API.
- Create an app. From the Developer Console dashboard click New App, then enter a name, description and use case.
- Save your credentials. The console generates your keys and tokens. X warns they're only displayed once, so store them in a password manager straight away.
If you lose them you'll have to regenerate them, which invalidates the old ones and breaks anything still using them.
Which X API keys you need
| Credential | What it's for |
|---|---|
| API Key and Secret | Identify your app; used to generate tokens and sign OAuth 1.0a requests |
| Bearer Token | App-only access for reading public data, such as searching posts or looking up users |
| Access Token and Secret | Requests as your own account, handy for testing or a personal bot |
| Client ID and Secret | OAuth 2.0 for acting on behalf of other users, with fine-grained scopes |
Rule of thumb from X's guide: reading public data needs only the Bearer Token; posting, liking, following or reading DMs for other people needs OAuth 2.0 (recommended) or OAuth 1.0a. If you're new to how apps talk to each other, my explainer on APIs versus webhooks is a good primer.
How billing works now
X describes the API as pay-per-usage with no subscriptions, contracts or minimum spend. You buy credits in the Developer Console and they're deducted as you make requests, with different endpoints costing different amounts. The same resource requested twice within a 24-hour UTC day is charged once.
X also runs two one-time incentives for new paying accounts, as of October 2026: $20 in free credits once an account with its first eligible card completes its first credit purchase, and a match of the first automatic recharge up to $50, so $70 in total. X says these credits expire three months after they're granted and are spent before your purchased credits. I've broken down the per-request rates on a separate page about X API pricing.
Rate limits
Rate limits cap how many requests you can make to each endpoint. Go over and you'll get a 429 error until the window resets. X's docs say windows are usually 15 minutes or 24 hours, limits apply per user when you use user tokens and per app when you use a Bearer Token, and every endpoint has its own limit. Each response tells you where you stand through three headers: the limit, the requests remaining and the reset time.
v2 or v1.1?
X recommends v2 for everything new. It's the version with pay-per-use pricing, flexible fields and expansions, post annotations, conversation tracking and edit history. v1.1 is described as legacy with limited support, kept for some media upload and specialised endpoints. X publishes official Python and TypeScript SDKs, and also lists Postman for testing.
Common jobs and the access they need
| What you want to do | Credential to use |
|---|---|
| Track mentions of your brand or a hashtag | Bearer Token with search or the filtered stream |
| Pull metrics for your own posts | Your own Access Token and Secret |
| Let customers post to X from your app | OAuth 2.0 with only the scopes you need |
| Run a bot from your own account | Your own Access Token and Secret |
Map your use case to a credential before you write any code. It decides which endpoints you can call, how rate limits apply to you and which requests you'll pay for.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
The Threads equivalent is covered in my guide to the Threads API.
Before you build
- Keep credentials in environment variables, never in your code or a git repository.
- Request only the OAuth permissions your app needs.
- Set a spending limit in the console while you test.
- Read the Developer Agreement and Policy; it governs what you can do with the data.
If you're choosing tooling around your integration, my roundup of API management platforms is a useful place to start.
My verdict
For a small business, the X API is now easier to start with than it was: no plan to pick, just credits, and a Bearer Token covers most read-only jobs like monitoring mentions or pulling your own post data. The risk is the bill, so set a spending limit on day one and watch usage in the console. If all you want is scheduling or analytics, an off-the-shelf tool that already pays for API access is usually cheaper than building your own.
What each access level includes is in my breakdown of the X API tiers.
Frequently asked questions
Is the Twitter API the same as the X API?
Yes. Twitter's API is now the X API, documented at docs.x.com, with access managed in the Developer Console at console.x.com.
How do I get an X API key?
Sign in at console.x.com with your X account, accept the Developer Agreement, create an app and save the API key, secret and tokens it generates. X shows them only once.
Is there a free X API tier?
X describes the API as pay-per-usage with credits and no subscriptions. New paying accounts can earn one-time free credits, which X says expire after three months.
What happens if I hit an X API rate limit?
You get a 429 error until the window resets. Response headers show your limit, the requests remaining and when the window resets.
