How to get a Twitter (X) API key

#How to get an official X API key, step by step

An official X API key comes from the X Developer Console at console.x.com, the site where X issues every credential for its API, and the route takes six steps. X's Getting Access guide (opens in a new tab) lists the first four. The credits in step 5 live on its pricing page, and the request in step 6 fails without them.

Opening a developer account and creating an app cost nothing. Reading does: X bills each post a response returns at $0.005 and each profile or follower at $0.010, from a balance you top up in advance. Our X API pricing breakdown lists every rate.

1. Sign in at console.x.com. Use the X account that should own the app; there is no separate developer login.

2. Accept the Developer Agreement. Read and accept X's Developer Agreement and Policy, then describe in plain words what you will build and which data it reads. X publishes no review time for this step.

3. Create an app. Click New App and enter a name, a description and a use case. The console generates the app's credentials as soon as it exists.

4. Save the credentials. Copy the API key and secret and the Bearer token. If the app will post or act for people, also copy the access token and secret or the OAuth 2.0 client ID and secret. Each value is shown once.

5. Buy credits. In the console, add a card and buy credits. Set a spending limit while you test; auto-recharge can wait until a job must never stop.

6. Send a test request. Look up a public account with the Bearer token in the Authorization header. A JSON object with id, name and username means the key works, and the lookup costs $0.010, the price of one user read.

   curl "https://api.x.com/2/users/by/username/XDevelopers" \
     -H "Authorization: Bearer $X_BEARER_TOKEN"
   

To read public posts and profiles, the Bearer token is the only credential your code sends. The access tokens and the OAuth 2.0 pair matter once the app posts or acts for other people, and the credential table below shows which is which.

#Get a Sorsa API key in about 3 minutes

To read public X data, use Sorsa API, a Twitter (X) API and scraper: one key replaces the app, its credentials and the credit balance, and tweets cost from $0.014 per 1,000. That is 250x below the official X API. No X account of yours takes part, so your account carries zero risk, and the key runs at 20 requests per second on every plan, free accounts included.

1. Sign up. Sign up with Google or an email address. There is no card, no X account and no review, and the account starts with 100 free requests that never expire.

2. Copy the key. The dashboard's overview page shows your API key. Store it in an environment variable on your server, such as SORSA_API_KEY.

3. Check the key for free. Call GET /key-usage-info (opens in a new tab) with the key in the ApiKey header. This call never counts against your requests, so testing a key costs nothing.

   curl "https://api.sorsa.io/v3/key-usage-info" \
     -H "ApiKey: YOUR_API_KEY"
   

   {
     "key_requests": 100,
     "remaining_requests": 100,
     "total_requests": 0
   }
   

remaining_requests is what the key can still spend. On a paid plan the response also carries valid_until, the date the current balance of requests expires; the 100 free requests have no such date. From here, every endpoint of Sorsa API, 45 in all, takes the same header: GET /info (opens in a new tab) returns a profile, and search, timelines, followers and batches of 100 tweets work the same way.

Set side by side, the Sorsa API key needs fewer parts, costs nothing to check and reads tweets for a small fraction of the official price:

• Sign up with

  Sorsa API key

  Email or Google

  Official X API key

  Your X account

• Before the key appears

  Sorsa API key

  Sign-up only

  Official X API key

  Developer Agreement, use description, an app

• What you store

  Sorsa API key

  1 API key

  Official X API key

  Up to 7 values: key and secret, Bearer token, access token and secret, client ID and secret

• Header on every request

  Sorsa API key

  ApiKey: <key>

  Official X API key

  Authorization: Bearer <token>

• Before the first read

  Sorsa API key

  100 free requests, no card

  Official X API key

  Prepaid credits, or HTTP 402

• Checking that the key works

  Sorsa API key

  GET /key-usage-info, free

  Official X API key

  A billed read, such as $0.010 for a profile

• Request rate

  Sorsa API key

  20 requests per second on every plan

  Official X API key

  Separate 15-minute windows for each endpoint

• 1,000 tweets

  Sorsa API key

  From $0.014

  Official X API key

  $5.00

In code, read the key from an environment variable, or paste it in place of YOUR_API_KEY for a first try, and stop on any status other than 200; the JSON's message says what went wrong.

import os
import requests

key = os.environ.get("SORSA_API_KEY", "YOUR_API_KEY")
r = requests.get("https://api.sorsa.io/v3/key-usage-info",
                 headers={"ApiKey": key}, timeout=30)
if r.status_code != 200:
    raise SystemExit(f"{r.status_code}: {r.json()['message']}")
print("requests left:", r.json()["remaining_requests"])

const key = process.env.SORSA_API_KEY ?? "YOUR_API_KEY";
const res = await fetch("https://api.sorsa.io/v3/key-usage-info", {
  headers: { ApiKey: key },
});
const body = await res.json();
if (!res.ok) throw new Error(`${res.status}: ${body.message}`);
console.log("requests left:", body.remaining_requests);

If the reason you came here is to avoid X's console altogether, the guide to the Twitter API without a developer account walks through the first reads: tweets, search and follower lists.

#Which X credential does what

The official X API issues four kinds of credentials, and reading public data needs only one of them, the Bearer token. The API key and secret, also called the consumer key and secret, identify your app and work as its username and password. X's API Key and Secret page (opens in a new tab) puts it in those words. The other credentials are made from them, or for a person who uses your app.

Only the Bearer token reads public posts by itself, so a script that never posts can ignore the other three rows:

• API key and secret (consumer key and secret)

  What it is

  Your app's identity

  Used for

  Signing OAuth 1.0a requests, minting the Bearer token

  Reads public posts alone

  No

• Bearer token

  What it is

  App-only OAuth 2.0 token

  Used for

  Public reads: posts, profiles, search

  Reads public posts alone

  Yes

• Access token and secret

  What it is

  OAuth 1.0a pair for the account that owns the app

  Used for

  Posting and acting as that account

  Reads public posts alone

  Yes, as that account

• OAuth 2.0 client ID and secret

  What it is

  Your app's identity in the sign-in flow

  Used for

  Letting other people sign in with X and act through your app

  Reads public posts alone

  No, they produce user tokens

A lost Bearer token can be minted again from the key and secret. X's Bearer token guide (opens in a new tab) sends them as a basic-auth pair to oauth2/token, and the access_token field of the JSON that comes back is the Bearer token:

curl -u "$X_API_KEY:$X_API_SECRET" \
  --data "grant_type=client_credentials" \
  "https://api.x.com/oauth2/token"

Permissions belong to the app, not the token. An app set to Read can't post. Switch it to Read and write in its user authentication settings, then generate the access token and secret again: a token keeps the permissions it was created with. A token made before the switch is a common cause of a 403 on the first post.

Pick the job your code has to do, and the picker names the credential, the header and the first request:

#X-API-Key, Bearer or ApiKey: which header

The official X API reads its token only from the Authorization: Bearer header, and Sorsa API reads its key only from the ApiKey header. Neither reads X-API-Key, a header name that many other APIs use for their keys. The name trips people up because it reads like "X API key", yet it has no link to X. API gateways and plenty of SaaS products use it, and a key placed there reaches X's servers as no key at all.

We sent the same requests to both APIs on November 2, 2026, with made-up keys, and each answer below is what came back:

• No key at all

  Sorsa API answered

  403 missing key in request header

  Official X API answered

  401 Unauthorized

• A made-up key in the right header

  Sorsa API answered

  401 invalid api key

  Official X API answered

  401 Unauthorized

• The key in an X-API-Key header

  Sorsa API answered

  403 missing key in request header

  Official X API answered

  401 Unauthorized

• The key as Authorization: Bearer

  Sorsa API answered

  403 missing key in request header

  Official X API answered

  401 Unauthorized

So a 401 from the official X API means the token is wrong, missing or sent the wrong way, and it doesn't say which. Sorsa API tells the two cases apart: 401 invalid api key means the value is wrong, and 403 missing key in request header means the header name is.

#When a new key fails: 401, 402, 403, 429

A new official X API key fails for four reasons, each with its own status code. 401 means a wrong or regenerated token, 402 an empty credit balance, 403 a missing permission or an app outside a project, and 429 a spent rate-limit window. The same numbers mean different things on Sorsa API, and the fix follows from the message:

• 401

  Sorsa API

  The key is wrong or was deleted (invalid api key)

  Official X API

  The token is wrong, missing or was regenerated

• 402

  Sorsa API

  Not used

  Official X API

  CreditsDepleted: the account has no credits

• 403

  Sorsa API

  No key in the ApiKey header, or the requests are used up

  Official X API

  The app lacks the permission, or isn't in a project (client-not-enrolled)

• 429

  Sorsa API

  More than 20 requests in one second

  Official X API

  The endpoint's 15-minute window is spent

The 402 is the error X's Getting Access guide never mentions. Its body carries the title CreditsDepleted and the line "Your enrolled account does not have any credits to fulfill this request.", as developers have posted on X's developer forum (opens in a new tab), and buying credits clears it. A balance can also dip slightly below zero, and then requests stay blocked until a top-up covers it.

The 403 client-not-enrolled says that keys must come from a developer app "attached to a Project". It shows up on older standalone apps; attaching the app to a project in the console, or creating a new app there, ends it. Rate limits on the official X API differ for every endpoint, and the X API rate limits guide lists them. On Sorsa API a 429 clears within a second, and failed requests are never charged, so the retry costs nothing.

#Keep the key secret, and replace it if it leaks

Treat every API key as a password: keep it in an environment variable or a secrets manager on your server, never in front-end code or a Git repository. Put the .env file that holds X_BEARER_TOKEN or SORSA_API_KEY in .gitignore before the first commit, because bots scan public repositories for keys.

A leaked key costs you on both APIs. On the official X API, X's best-practices page (opens in a new tab) warns that a stolen key can use up your paid access or get the app suspended. On Sorsa API, it spends your requests.

• Official X API: open the app's Keys and tokens tab and click Regenerate next to the leaked credential. The old value stops working at once, so update every server that used it. A Bearer token can also be invalidated through oauth2/invalidate_token and minted again.
• Sorsa API: on the API Keys page of the dashboard, create a new key and delete the leaked one. The old key stops at once and answers 401.

Sorsa API keys belong in server-side code only: browsers can't call the API directly, and a key in front-end JavaScript is readable by anyone who opens the page.

Good to know

X shows each credential once, at the moment it is generated. Paste it straight into your password manager or secrets store. If you close the page first, the only way back is to regenerate it, which breaks every script still holding the old value.

#Start with the key that reads data today

An official X API key takes six steps and a credit balance before the first answer, and each post it reads costs $0.005. For reading public X data, use a Sorsa API key: one sign-up, one header, and tweets from $0.014 per 1,000. Copy the key, check it for free, and spend the 100 free requests on up to 10K tweets before you pay anything. To publish posts as well, keep a small official app for writing and read everything through Sorsa API.

#FAQ