Getting Access

Get started with the X API in three steps: sign up, create an app, and save your credentials. After signing up, create an app to get your API credentials:

Get started with the X API in three steps: sign up, create an app, and save your credentials.

Sign up now

---

Step 1: Create a developer account

1. Go to the Developer Console

   Visit console.x.com and sign in with your X account.

2. Accept the Developer Agreement

   Review and accept the Developer Agreement and Policy.

3. Complete your profile

   Provide basic information about how you’ll use the API.

---

Step 2: Create an app

After signing up, create an app to get your API credentials:

1. Click 'New App'

   From the Developer Console dashboard, create a new app.

2. Enter app details

   Provide a name, description, and use case for your app.

3. Generate credentials

   The console will generate your API keys and tokens.

---

Step 3: Save your credentials

You’ll receive several credentials depending on your authentication needs:

Credential	Purpose
API Key & Secret	Identify your app. Used to generate tokens and sign OAuth 1.0a requests.
Bearer Token	App-only authentication for reading public data.
Access Token & Secret	Make requests on behalf of your own account (OAuth 1.0a).
Client ID & Secret	OAuth 2.0 authentication for user-context requests.

Save immediately. Credentials are only displayed once. Store them in a password manager or secure vault. If you lose them, you’ll need to regenerate (which invalidates the old ones).

---

Which credentials do you need?

Reading public data

Use the Bearer Token for simple, read-only access to public data.

curl "https://api.x.com/2/users/by/username/xdevelopers" \
  -H "Authorization: Bearer $BEARER_TOKEN"

Best for: Searching posts, looking up users, reading trends.

Acting as a user

Use OAuth 2.0 (recommended) or OAuth 1.0a to act on behalf of users.

OAuth 2.0 offers fine-grained scopes—request only the permissions you need.

Best for: Posting, liking, following, accessing DMs.

OAuth 2.0 guide →

Acting as yourself

Use your Access Token & Secret to make requests as your own account.

These tokens represent the account that owns the app.

Best for: Testing, personal bots, your own automation.

---

Credential security best practices

Use environment variables

Never hardcode credentials in your source code.

Don't commit to git

Add credential files to .gitignore.

Rotate regularly

Regenerate credentials periodically as a security measure.

Use minimal scopes

Only request the OAuth permissions your app needs.

---

Next steps

Make your first request

Call the API with your new credentials.

Learn about authentication

Understand OAuth 1.0a and OAuth 2.0.