X — how to connect

Posts tweets to X (Twitter) via the v2 API. Add your X app's OAuth 2.0 client ID and secret below, then connect with OAuth — or skip setup here and paste your four OAuth 1.0a API keys (consumer key/secret + access token/secret) directly when you add the account. Note: X read/sync calls are pay-per-use under the 2026 pricing and may hit rate limits on free-tier tokens.

X (Twitter) posting uses OAuth 2.0 Authorization Code with PKCE. You register one OAuth 2.0 app in the X developer portal to get a Client ID and Client Secret, which power the in-app "Connect with OAuth" button; individual accounts then authorize through that flow.

Before you start

A developer.x.com account with an App that is attached to a Project — as of 2026, X requires Project-attached apps for v2 write endpoints; a standalone/orphaned app returns 403s even with correct scopes.
An active X API plan with posting credit: the free tier is discontinued for new developers, so you're on Pay-Per-Use (billed per post, ~$0.015/post) or a legacy Basic/Pro subscription — either way there must be a payment method on file and a non-zero balance, or POST /2/tweets returns 403 even though auth succeeds.
For the OAuth 2.0 path: the app's User authentication settings must have 'Read and write' permission enabled (not just 'Read') and a Callback/Redirect URI matching exactly what this tool sends — set both under the app's 'User authentication settings' before connecting.
For the OAuth 1.0a / API-keys path (the four-key fallback): the Access Token must be regenerated with Read + Write permission AFTER the app permission is changed to Read/Write — X does not retroactively upgrade tokens generated while the app was Read-only.

Step by step

1
Create or open a project and app
Sign in at console.x.com, create a Project and App (or use an existing one) under your developer account.
Open
2
Turn on OAuth 2.0 user authentication
In the app's "User authentication settings", click Set up, choose Web App/Automated App/Bot (a confidential client, so you get a Client Secret), and enable Read and write permissions.
3
Add the callback URL and required app info
Add this tool's OAuth redirect URI to the app's Callback URI/Redirect URL allowlist (exact match required) and fill in the mandatory Website URL, Terms of Service, and Privacy Policy fields.
4
Copy the Client ID and Client Secret
Open Keys and Tokens, copy the OAuth 2.0 Client ID and Client Secret, and paste them into this app's Client ID / Client secret config fields.
5
Connect the account
Click Connect with OAuth in this tool to run the authorization-code+PKCE flow (scope includes tweet.write) and link the X account.

App keys (set once in Settings)

OAuth 2.0 Client ID
developer.x.com → your app → Keys and Tokens → "OAuth 2.0 Client ID and Client Secret" → Client ID. This is NOT the API Key (that's the OAuth 1.0a "paste keys" path). Enable Read+Write under User authentication settings first.
OAuth 2.0 Client Secretsecret
Same "OAuth 2.0 Client ID and Client Secret" section → Client Secret. Only issued for confidential app types (Web App / Automated App / Bot).

Paste when you connect

API Key (a.k.a. Consumer Key)
developer.x.com → your app → Keys and Tokens → "Consumer Keys" → API Key. X labels these interchangeably "API Key" / "Consumer Key" — same value. NOT the OAuth 2.0 Client ID.
API Key Secret (a.k.a. Consumer Secret)secret
Same "Consumer Keys" box → API Key Secret (the second value, revealed once). NOT the OAuth 2.0 Client Secret.
Access Token
Keys and Tokens → "Access Token and Secret" → Access Token. Regenerate it AFTER setting the app to Read and write, or posting 403s.
Access Token Secretsecret
Same "Access Token and Secret" box → the second value (the secret).

Good to know

Redirect URI must match exactly, including trailing slash, or authorization fails.
Only confidential client app types (Web App/Automated App/Bot) receive a Client Secret; public/native app types do not.
The app's User authentication settings must have Read and write access, not just Read, or tweet.write will be rejected.
X read/sync API calls are pay-per-use under 2026 pricing and free-tier tokens can hit rate limits quickly, per the adapter's own description.
You can skip OAuth entirely and instead paste OAuth 1.0a keys (API Key/Secret + Access Token/Secret with Read+Write access) directly when adding the account, if you prefer not to register an OAuth2 app.

Troubleshooting

Connect or publish fails with 403 'You are not permitted to perform this action', even though the OAuth flow completed and the token looks valid.: This is almost always a plan/billing gap, not a scope bug: confirm the app is attached to a Project in developer.x.com, and that the account has an active paid plan (Pay-Per-Use with a funded balance, or Basic/Pro) — free-tier or unfunded accounts get 403 on POST /2/tweets regardless of scopes.
OAuth 2.0 token exchange fails with 'unauthorized_client' right after the user approves access.: X apps are confidential clients by default, so the token request must send HTTP Basic auth (client_id:client_secret) — the adapter already does this via X_CLIENT_ID/X_CLIENT_SECRET; if this still fails, re-check the Callback URI configured in the X app matches the redirect_uri sent byte-for-byte (trailing slash, http vs https).
Posting works at first, then starts failing after ~2 hours with 401, or refresh silently stops updating the token.: OAuth 2.0 access tokens expire (short-lived) and require the refresh_token grant with offline_access scope — confirm 'offline access' was granted at connect time; if the account was connected before offline_access was requested, disconnect and reconnect to get a refresh token issued.
Pasting the four OAuth 1.0a keys (API Key/Secret + Access Token/Secret) verifies fine on GET /2/users/me but publish() fails with 403.: Read/Write access token must be generated AFTER the app's permission level was set to 'Read and write' in the developer portal — regenerate the Access Token and Secret (not just re-copy the old ones) and re-paste all four keys.

X developer docs

X — how to connect

Before you start

A developer.x.com account with an App that is attached to a Project — as of 2026, X requires Project-attached apps for v2 write endpoints; a standalone/orphaned app returns 403s even with correct scopes.

An active X API plan with posting credit: the free tier is discontinued for new developers, so you're on Pay-Per-Use (billed per post, ~$0.015/post) or a legacy Basic/Pro subscription — either way there must be a payment method on file and a non-zero balance, or POST /2/tweets returns 403 even though auth succeeds.

For the OAuth 2.0 path: the app's User authentication settings must have 'Read and write' permission enabled (not just 'Read') and a Callback/Redirect URI matching exactly what this tool sends — set both under the app's 'User authentication settings' before connecting.

For the OAuth 1.0a / API-keys path (the four-key fallback): the Access Token must be regenerated with Read + Write permission AFTER the app permission is changed to Read/Write — X does not retroactively upgrade tokens generated while the app was Read-only.

Step by step

Create or open a project and app

Open

Turn on OAuth 2.0 user authentication

In the app's "User authentication settings", click Set up, choose Web App/Automated App/Bot (a confidential client, so you get a Client Secret), and enable Read and write permissions.

Add the callback URL and required app info

Add this tool's OAuth redirect URI to the app's Callback URI/Redirect URL allowlist (exact match required) and fill in the mandatory Website URL, Terms of Service, and Privacy Policy fields.

Copy the Client ID and Client Secret

Open Keys and Tokens, copy the OAuth 2.0 Client ID and Client Secret, and paste them into this app's Client ID / Client secret config fields.

Connect the account

Click Connect with OAuth in this tool to run the authorization-code+PKCE flow (scope includes tweet.write) and link the X account.

App keys (set once in Settings)

OAuth 2.0 Client ID

developer.x.com → your app → Keys and Tokens → "OAuth 2.0 Client ID and Client Secret" → Client ID. This is NOT the API Key (that's the OAuth 1.0a "paste keys" path). Enable Read+Write under User authentication settings first.

OAuth 2.0 Client Secretsecret

Same "OAuth 2.0 Client ID and Client Secret" section → Client Secret. Only issued for confidential app types (Web App / Automated App / Bot).

Paste when you connect

API Key (a.k.a. Consumer Key)

developer.x.com → your app → Keys and Tokens → "Consumer Keys" → API Key. X labels these interchangeably "API Key" / "Consumer Key" — same value. NOT the OAuth 2.0 Client ID.

API Key Secret (a.k.a. Consumer Secret)secret

Same "Consumer Keys" box → API Key Secret (the second value, revealed once). NOT the OAuth 2.0 Client Secret.

Access Token

Keys and Tokens → "Access Token and Secret" → Access Token. Regenerate it AFTER setting the app to Read and write, or posting 403s.

Access Token Secretsecret

Same "Access Token and Secret" box → the second value (the secret).

Good to know

Redirect URI must match exactly, including trailing slash, or authorization fails.

Only confidential client app types (Web App/Automated App/Bot) receive a Client Secret; public/native app types do not.

The app's User authentication settings must have Read and write access, not just Read, or tweet.write will be rejected.

X read/sync API calls are pay-per-use under 2026 pricing and free-tier tokens can hit rate limits quickly, per the adapter's own description.

You can skip OAuth entirely and instead paste OAuth 1.0a keys (API Key/Secret + Access Token/Secret with Read+Write access) directly when adding the account, if you prefer not to register an OAuth2 app.

Troubleshooting

Connect or publish fails with 403 'You are not permitted to perform this action', even though the OAuth flow completed and the token looks valid.

This is almost always a plan/billing gap, not a scope bug: confirm the app is attached to a Project in developer.x.com, and that the account has an active paid plan (Pay-Per-Use with a funded balance, or Basic/Pro) — free-tier or unfunded accounts get 403 on POST /2/tweets regardless of scopes.

OAuth 2.0 token exchange fails with 'unauthorized_client' right after the user approves access.

X apps are confidential clients by default, so the token request must send HTTP Basic auth (client_id:client_secret) — the adapter already does this via X_CLIENT_ID/X_CLIENT_SECRET; if this still fails, re-check the Callback URI configured in the X app matches the redirect_uri sent byte-for-byte (trailing slash, http vs https).

Posting works at first, then starts failing after ~2 hours with 401, or refresh silently stops updating the token.

OAuth 2.0 access tokens expire (short-lived) and require the refresh_token grant with offline_access scope — confirm 'offline access' was granted at connect time; if the account was connected before offline_access was requested, disconnect and reconnect to get a refresh token issued.

Pasting the four OAuth 1.0a keys (API Key/Secret + Access Token/Secret) verifies fine on GET /2/users/me but publish() fails with 403.

Read/Write access token must be generated AFTER the app's permission level was set to 'Read and write' in the developer portal — regenerate the Access Token and Secret (not just re-copy the old ones) and re-paste all four keys.