{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"1be96abbfb292ed304341aae1ef7c30614fac37386402d112ad10ab91da478b4","entry":{"id":"x/developer-api","name":"X API (developer console, app and keys)","vendor":"X Corp","summary":"Sign in to the X Developer Console with an X account, accept the Developer Agreement and Policy, describe your use case, create an app, buy prepaid pay-per-use credits, and copy the app's keys and tokens (shown once).","aliases":["twitter-api","twitter/developer-api","x-api"],"category":"social","group":"B","homepage":"https://developer.x.com/","docs":["https://docs.x.com/x-api/getting-started/getting-access","https://docs.x.com/x-api/getting-started/pricing","https://docs.x.com/fundamentals/developer-apps"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"getting-access","url":"https://docs.x.com/x-api/getting-started/getting-access","title":"X API - Getting access","accessed":"2026-10-25","supports":"Console sign-in, Developer Agreement acceptance, profile with use-case info, New App, credential types, credentials shown once","kind":"official"},{"id":"pricing","url":"https://docs.x.com/x-api/getting-started/pricing","title":"X API - Pricing","accessed":"2026-10-25","supports":"Pay-per-usage prepaid credits, per-unit prices, 3M post-read cap, spending limits, auto-recharge, negative balance blocks requests, $20 starter credit, xAI credit back","kind":"official"},{"id":"developer-apps","url":"https://docs.x.com/fundamentals/developer-apps","title":"X API - Developer apps","accessed":"2026-10-25","supports":"Permission levels, re-authorisation after permission change, callback URL allowlist (max 10, exact match, 127.0.0.1 not localhost), OAuth 2.0 app types, key regeneration","kind":"official"},{"id":"developer-policy","url":"https://docs.x.com/developer-terms/policy","title":"X Developer Policy","accessed":"2026-10-25","supports":"No bulk/aggressive/spammy actions, no circumventing rate limits, no multiple apps for one use case (max 3 for dev/staging/prod), redistribution limited to IDs (1.5M Post IDs per 30 days), off-X matching needs opt-in, suspension or revocation","kind":"official"},{"id":"developer-agreement","url":"https://docs.x.com/developer-terms/agreement","title":"X Developer Agreement","accessed":"2026-10-25","supports":"Ban on using X API/Content to fine-tune or train a foundation or frontier model; age 13+ (18+ for paid services); verified phone number required to subscribe; termination for any reason","kind":"official"}],"allowed_domains":["x.com"],"account_model":{"summary":"Everything hangs off an ordinary X user account. The developer account is created by signing that account in to the Developer Console; apps live under it and each app has its own keys. Credits and billing sit on the developer account.","accounts":[{"name":"X user account","kind":"personal","owned_by":"the person (or a company-controlled X account)","required":true,"note":"The account that signs in to console.x.com and owns the apps. A verified phone number is required to subscribe to paid services."},{"name":"X developer account","kind":"developer","parent":"X user account","required":true,"note":"Created by accepting the Developer Agreement and Policy and completing the profile in the Developer Console."},{"name":"App","kind":"project","parent":"X developer account","required":true,"note":"Holds the API key/secret, bearer token, access token/secret and OAuth 2.0 client id/secret. Policy allows separate apps only for dev, staging and production of the same service (up to 3)."}],"notes":["Credits are prepaid and deducted per request; a negative balance blocks API requests."]},"prerequisites":[{"need":"An X account you control, with a verified phone number","note":"The Developer Agreement requires a verified phone number to subscribe to paid services."}],"have_ready":[{"kind":"phone_for_2fa","description":"A phone number verified on the X account","why":"X requires a verified phone number to subscribe to a paid service.","needed_for":["buy-credits"],"auto_check":"none","source":"developer-agreement"},{"kind":"payment_card","description":"A payment card for prepaid X API credits","why":"Access is pay-per-use with prepaid credits; the $20 starter credit needs a saved card and a first purchase.","needed_for":["buy-credits"],"auto_check":"none","source":"pricing"},{"kind":"other","description":"A short, honest description of how you will use the API","why":"The console profile asks for basic information about how you'll use the API, and each app asks for a use case.","needed_for":["developer-profile","create-app"],"auto_check":"none","source":"getting-access"},{"kind":"other","description":"Your OAuth callback URL(s), using HTTPS in production and http://127.0.0.1 (not localhost) for local work","why":"Callback URLs must match the app's allowlist exactly (max 10 per app).","needed_for":["user-auth-settings"],"auto_check":"none","source":"developer-apps"}],"steps":[{"id":"sign-in","title":"Sign in to the X Developer Console","summary":"Sign in at console.x.com with the X account that will own the apps. You sign in yourself; verapli never handles your X password.","route":"guided","depends_on":[],"gate":"human_login","url":"https://console.x.com/","sources":["getting-access"]},{"id":"developer-profile","title":"Accept the Developer Agreement and complete your profile","summary":"Read and accept the Developer Agreement and Policy, then fill in basic information about how you'll use the API. Describe the real use case; the policy forbids extra apps for the same use case.","route":"guided","depends_on":["sign-in"],"gate":"human_terms","url":"https://console.x.com/","sources":["getting-access","developer-policy"]},{"id":"create-app","title":"Create an app","summary":"Click New App and enter a name, description and use case. The console then generates the app's keys and tokens.","route":"guided","depends_on":["developer-profile"],"gate":"human_submit","url":"https://console.x.com/","recovery":[{"hiccup":"You lost a key or secret after closing the dialog","fix":"Credentials are only shown once. Regenerate them in the console; the old values stop working, so update every place that used them.","source":"getting-access"}],"sources":["getting-access"]},{"id":"buy-credits","title":"Add a card, buy credits and set a spending limit","summary":"Save a payment method and buy prepaid credits on X's billing page (you enter card details yourself). Set a maximum spend per billing cycle, and optionally auto-recharge with a threshold.","route":"guided","depends_on":["create-app"],"gate":"human_payment","url":"https://console.x.com/","recovery":[{"hiccup":"API calls start failing although the keys are right","fix":"Check the credit balance and spending limit. A negative balance or a reached spend cap blocks requests until you add credits or the next cycle starts.","source":"pricing"}],"sources":["pricing"]},{"id":"user-auth-settings","title":"Set app permissions and user authentication","summary":"Choose the permission level (Read; Read and write; Read, write and DMs), pick the OAuth 2.0 app type (Web App, Automated App/Bot, Native App, Single Page App) and add the exact callback URLs.","route":"guided","depends_on":["create-app"],"gate":"human_submit","url":"https://console.x.com/","recovery":[{"hiccup":"Write calls fail after you changed permissions","fix":"Changing permissions requires users (including you) to re-authorise the app to get new tokens.","source":"developer-apps"},{"hiccup":"OAuth redirect fails with a callback error","fix":"The callback must match an allowlisted URL exactly. Use http://127.0.0.1 rather than localhost locally.","source":"developer-apps"}],"optional":true,"sources":["developer-apps"]},{"id":"copy-keys","title":"Copy the keys and tokens into your env file","summary":"Copy the API key and secret, bearer token, and (if needed) access token/secret and OAuth 2.0 client id/secret. verapli captures them by selector and writes them only to your own files.","route":"guided","depends_on":["create-app"],"gate":"none","capture":{"env":"X_BEARER_TOKEN","kind":"token"},"sources":["getting-access"]}],"outputs":[{"name":"X_API_KEY","description":"App API key (consumer key), identifies the app and signs OAuth 1.0a requests","secret":true,"from_step":"copy-keys"},{"name":"X_API_SECRET","description":"App API key secret","secret":true,"from_step":"copy-keys"},{"name":"X_BEARER_TOKEN","description":"App-only bearer token for reading public data","secret":true,"from_step":"copy-keys"},{"name":"X_ACCESS_TOKEN","description":"Access token acting as the account that owns the app (OAuth 1.0a)","secret":true,"from_step":"copy-keys"},{"name":"X_ACCESS_TOKEN_SECRET","description":"Access token secret (OAuth 1.0a)","secret":true,"from_step":"copy-keys"},{"name":"X_CLIENT_ID","description":"OAuth 2.0 client id for user-context requests","secret":false,"from_step":"user-auth-settings"},{"name":"X_CLIENT_SECRET","description":"OAuth 2.0 client secret (confidential clients only; public clients use PKCE)","secret":true,"from_step":"user-auth-settings"}],"terms_notes":[{"kind":"rules_say","severity":"red","title":"No bulk or spammy automation","text":"The Developer Policy says never to perform bulk, aggressive or spammy actions, and automated replies or DMs need explicit consent first. Breaches can lead to suspension or permanent revocation of API access.","source":"developer-policy"},{"kind":"rules_say","severity":"red","title":"One app per use case","text":"You may not register multiple applications for the same or overlapping use case; the exception is up to three apps for development, staging and production of one service. Do not create extra apps to get more rate limit.","source":"developer-policy"},{"kind":"rules_say","severity":"red","title":"No circumventing rate limits","text":"You may not exceed or circumvent X API rate limits.","source":"developer-policy"},{"kind":"rules_say","severity":"red","title":"No training foundation models","text":"The Developer Agreement forbids using the X API or X Content to fine-tune or train a foundation or frontier model.","source":"developer-agreement"},{"kind":"rules_say","severity":"amber","title":"Redistribution is IDs only","text":"You may only distribute Post IDs, DM IDs and/or User IDs, capped at 1,500,000 Post IDs per entity in any 30-day period. Matching X accounts to off-X identities needs express opt-in consent.","source":"developer-policy"},{"kind":"rules_say","severity":"amber","title":"Costs accrue per request","text":"Pay-per-use reads are billed per resource returned and writes per request (e.g. $0.005 per post read, $0.015 per post created, $0.200 per post created with a URL). Set a spending limit to avoid surprises.","source":"pricing"},{"kind":"rules_say","severity":"yellow","title":"X can terminate for any reason","text":"X may terminate the agreement for any reason at its sole discretion, and immediately on notice for breach.","source":"developer-agreement"}],"pricing_notes":{"free_tier":"No ongoing free tier is described on the pricing page. $20 of credits after saving a card and making a first eligible purchase; first auto-recharge matched up to $50.","costs":"Prepaid pay-per-use. Examples: post read $0.005; user read $0.010; post create $0.015; post create with URL $0.200; owned reads $0.001. Pay-per-use is capped at 3 million post reads per monthly cycle; more needs Enterprise.","notes":"Spending limit per billing cycle and auto-recharge available. Up to 20% back as xAI API credits by spend band. Legacy Basic/Pro plans are not described on the current pricing page [to verify].","source":"pricing"},"stripe_projects":false,"api_provisioning":{"available":"no","notes":"Developer account, apps and billing are set up in the Developer Console UI. Keys can be regenerated there; no public API for creating apps was found.","source":"getting-access"},"detect":{"env_names":["X_BEARER_TOKEN","TWITTER_BEARER_TOKEN","X_API_KEY","TWITTER_API_KEY"],"packages":["twitter-api-v2","tweepy"]}}}