How to Get an X (Twitter) API Key and Bearer Token (2026)

November 9, 2026

An X API key is the credential your code sends to X so it knows which app is calling. Every X app gets four credential pairs, and most people only need one of them, the Bearer Token. This guide walks through the Developer Console as X documents it today, then gets you to a working request. For prices, see Is the X (Twitter) API free?; this page covers access only.

What you need before you start

• An X account you control. The developer account is tied to it.
• A short description of what you will build. X asks for your intended use when you complete your profile.
• A card, if you want calls to go beyond a test. X bills reads and writes from prepaid credits (X pricing).
• A safe place for secrets, such as a password manager or your host's secret store. X's getting access page warns that credentials are displayed once.

How to get a Twitter API key, step by step

1. Open the Developer Console. Go to console.x.com and sign in with your X account.
2. Accept the terms. Read and accept the Developer Agreement and Policy.
3. Complete your developer profile. Describe your intended use. Be specific: "read public posts that mention our brand for a weekly report" is better than "research".
4. Create an app. On the dashboard, click New App (some X pages call it Create App). Enter a name, a description and your use case.
5. Generate credentials. X shows the API Key and Secret, Bearer Token and, if you ask for it, an Access Token and Secret for your own account. Copy each into your secret store now.
6. Pick the app type and permissions. In the app's settings, choose Web App or Automated App / Bot for server code, or Native App / Single Page App for public clients. Set OAuth 1.0a permissions to Read only unless you need to post.
7. Add credits. Buy credits and set a spending limit per billing cycle so a loop cannot drain your balance.

API key vs bearer token vs access token

X's developer apps page lists four credential types. Here is which one to use for what:

Confidential app types (Web App, Automated App / Bot) get a Client Secret. Public types (Native App, Single Page App) do not and must use PKCE. If you change OAuth 1.0a permissions later, users must re-authorize to get new tokens.

Make your first X API request

This is the request X uses in its own first request guide. It looks up one account by username with the Bearer Token:

export BEARER_TOKEN="paste-your-bearer-token"
curl "https://api.x.com/2/users/by/username/xdevelopers" \
  -H "Authorization: Bearer $BEARER_TOKEN"

A working token returns:

{"data":{"id":"2244994945","name":"X Developers","username":"xdevelopers"}}

The same call in Python, with the fields most people want:

import os
import requests

TOKEN = os.environ["BEARER_TOKEN"]

r = requests.get(
    "https://api.x.com/2/users/by/username/xdevelopers",
    headers={"Authorization": f"Bearer {TOKEN}"},
    params={"user.fields": "created_at,description,public_metrics"},
    timeout=30,
)
print(r.status_code, r.headers.get("x-rate-limit-remaining"))
r.raise_for_status()
user = r.json()["data"]
print(user["username"], user["public_metrics"]["followers_count"])

Cost check: a user lookup is one User resource, billed at $0.010 under X's pay-per-use rates. Pulling that user plus 100 of their posts is about $0.51. The full price table and a cost formula are in the X API pricing post.

Generate a bearer token from your API key

If you lost the Bearer Token, you can mint one from the API Key and Secret. X's bearer token docs show this request:

curl -u "$API_KEY:$API_SECRET_KEY" \
  --data 'grant_type=client_credentials' \
  'https://api.x.com/oauth2/token'

The answer is {"token_type":"bearer","access_token":"..."}. Use the access_token value as your Bearer Token.

X access tokens for other users: OAuth 2.0 and refresh

To act for someone else, send them to https://x.com/i/oauth2/authorize with response_type=code, your client_id, redirect_uri, state, code_challenge, code_challenge_method and scope. Exchange the returned code at POST https://api.x.com/2/oauth2/token. Per X's authorization code docs, the access token lasts two hours. Ask for the offline.access scope to also get a refresh token, then refresh like this:

curl -X POST "https://api.x.com/2/oauth2/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  --data "grant_type=refresh_token&refresh_token=$REFRESH_TOKEN&client_id=$CLIENT_ID"

Public clients leave out the -u line, since they have no secret.

X API rate limits you will hit first

Limits are per 15-minute window, and every response carries x-rate-limit-limit, x-rate-limit-remaining and x-rate-limit-reset headers (X rate limits).

Recent search returns 10 posts by default and up to 100 per page, with queries up to 512 characters. Pay-per-use also caps Post reads at 3 million per monthly cycle.

Common X API errors and fixes

The problem types come from X's error reference; read the type field in the error body before you guess.

Keep your X keys safe

• Store keys in environment variables or a secret manager, never in a repo or a browser bundle.
• Use one app per project, so revoking one key does not break the rest.
• X recommends you regenerate keys periodically and right away if you suspect a leak. Old values stop working when you do.
• Set a per-cycle spending limit. A runaway search loop is the most common surprise bill.

If you just need public data

If all you want is public profiles, posts and search, a ScrapeIO key skips the console, the app and the credit top-up. Use the X profile API, the X user posts API and the X search API, which accepts X search operators. Each call costs 1 credit, not-found accounts are free, and new accounts get 100 credits. Agents can use the X MCP server; the trade-offs are in X API vs scraping.

curl "https://scrapeio.com/v1/twitter/profile?handle=xdevelopers" \
  -H "x-api-key: YOUR_KEY"

FAQ

Is the X API key free?

Creating the key costs nothing, but calls are billed from prepaid credits. X lists no free tier on its pricing page.

Do I need approval for an X developer account?

X's getting access page describes no review: you accept the terms, describe your use, and create an app.

Where do I find my Twitter bearer token?

On your app's keys and tokens page in the Developer Console. If you lost it, generate a new one from your API Key and Secret with the client_credentials request above.

How long does an X access token last?

OAuth 2.0 user access tokens last two hours. Request offline.access to get a refresh token and renew them without asking the user again.

What is the difference between the API key and the consumer key?

They are the same thing. Older X docs said consumer key; the console says API Key.

Sources

Checked on 9 November 2026 from each vendor's own pages. Prices and limits change; follow the links before you decide.

• https://docs.x.com/x-api/getting-started/getting-access
• https://docs.x.com/fundamentals/developer-apps
• https://docs.x.com/x-api/getting-started/pricing
• https://docs.x.com/fundamentals/authentication/oauth-2-0/bearer-tokens
• https://docs.x.com/x-api/getting-started/make-your-first-request
• https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code
• https://docs.x.com/x-api/fundamentals/rate-limits
• https://docs.x.com/x-api/fundamentals/response-codes-and-errors