Twitter/X API in 2026: Complete Developer Guide

X API Pricing Tiers (2026)

The free tier is surprisingly useful. 50 tweets per day covers most individual automation use cases. Tools like AutoTweet start on the free tier and upgrade to Basic when they pass ~20 active users.

Authentication: OAuth 2.0 with PKCE

The recommended authentication method for X API v2 is OAuth 2.0 with PKCE (Proof Key for Code Exchange). Here's how it works:

1. Generate a code verifier — a random 64-character string
2. Create a code challenge — SHA-256 hash of the verifier, base64url-encoded
3. Redirect user to X authorization URL — with client_id, redirect_uri, scope, state, code_challenge
4. User authorizes your app — X redirects back with an authorization code
5. Exchange code for tokens — POST to https://api.x.com/2/oauth2/token with the code + code_verifier
6. Store the access + refresh tokens — access tokens expire in 2 hours, use refresh tokens to get new ones

Scopes to request: tweet.read tweet.write users.read offline.access covers most use cases. offline.access is required for refresh tokens.

Key API v2 Endpoints

Post a Tweet

POST /2/tweets — Creates a new tweet.

{
  "text": "Hello from the X API v2!"
}

Get User Info

GET /2/users/me — Returns the authenticated user's profile. Useful for verifying tokens after OAuth.

Get Tweet Metrics

GET /2/tweets?ids=123,456&tweet.fields=public_metrics — Returns impression count, likes, retweets, replies for specified tweets.

Delete a Tweet

DELETE /2/tweets/:id — Deletes a tweet by ID. Requires the tweet.write scope.

Rate Limits

X enforces rate limits per endpoint per 15-minute window:

• POST /2/tweets: Free tier = 50/day. Basic = 50,000/month (not per-window).
• GET /2/users/me: 75 requests per 15 minutes.
• GET /2/tweets: 300 requests per 15 minutes (Free), 900 (Basic).

Rate limit headers: Every API response includes x-rate-limit-limit, x-rate-limit-remaining, and x-rate-limit-reset headers. Use these to throttle your requests.

Recommended Libraries

• Node.js: twitter-api-v2 (the most popular, used by AutoTweet)
• Python: tweepy (v2 support) or python-twitter-v2
• Go: go-twitter
• Rust: egg-mode

API Safety: How to Avoid Bans

• Always use the official API. Browser automation and unofficial endpoints get accounts banned.
• Respect rate limits. Monitor the rate limit headers and back off when approaching limits.
• Use conservative posting patterns. Don't post 50 tweets in 1 minute. Spread them across the day.
• Store tokens securely. Never expose access tokens in client-side JavaScript or public repos.
• Implement token refresh. Access tokens expire every 2 hours. Use refresh tokens to get new ones silently.

AutoTweet is built on the official X API v2 with conservative rate limiting and automatic token refresh — keeping your account safe while automating your posting schedule.

FAQ