WEIR
Get a key
Language中文日本語
Theme

X API Bearer Token: Get, Test and Regenerate It (2026)

Find your X API bearer token at console.x.com, test it with one curl line, see which endpoints take it, and fix 401 vs 403 with X's real error text.


Published · Updated · 7 min read

Cover image: One header, public data only

An X API bearer token is an app-only key for reading public X data, and it lives in your app at console.x.com.

This guide is for developers and AI agent builders making a first X (Twitter) API call. You get X's Console steps, a tested request, and the fixes for 401 and 403.

Test any token in one line. It prints the HTTP status:

curl -s -o /dev/null -w "%{http_code}\n" \
  "https://api.x.com/2/users/by/username/xdevelopers" \
  -H "Authorization: Bearer $BEARER_TOKEN"

A 200 means the token works. Our made-up token printed 401.

You need: an X account, an app in the X Developer Console, and credits for calls that return data.

  1. Open your appSign in at console.x.com.
  2. Copy the Bearer TokenX shows it once.
  3. Store it safelyAn environment variable, not your code.
  4. Make a test callA user lookup costs $0.010.
  5. Regenerate if it leaksThe old token dies at once.

Step 1: Find your X API bearer token in the Developer Console

X's getting-access page sends you to console.x.com. Older X pages call it the Developer Portal, at developer.x.com.

  1. Sign in with your X account, and accept X's Developer Agreement and Policy if you're new.
  2. Create an app. X's getting-access page says to click New App; its apps page says Create App.
  3. Copy the Bearer Token now. A new app shows it next to the API key and secret, and X's API key page says "we only display these credentials once."
  4. Lost it? Open the Apps menu in the side bar, pick your app, and generate a new one on its Keys and tokens tab.

X calls this app-only authentication: calls made "on behalf of the application itself, as opposed to on behalf of a specific user." No request needs a signature.

The other credentials are in our guide on how to get an X API key.

Step 2: Keep the bearer token out of your code

X's app-only guide puts it plainly: "Tokens are passwords."

On pay-per-use, a stolen token can also "use up your paid access allotment," X's best-practices page warns. So set it in your shell, never in a file you commit:

export BEARER_TOKEN="paste-your-token-here"
  • Keep .env files out of git. X notes that a key deleted from code is "likely still accessible" in old commits, so regenerate it.
  • Keep it off browsers and phones. X's security page says never expose tokens "in client-side code, logs, or repositories."
  • Don't paste it into an AI chat. X's MCP guide warns against pasting tokens "into chats." Give your agent the variable's name instead.

Step 3: Make your first call with the bearer token

The test at the top already sent your token. Here is the same call in Python's standard library, for agent sandboxes without pip:

import json, os, urllib.error, urllib.request

url = "https://api.x.com/2/users/by/username/xdevelopers"
req = urllib.request.Request(url, headers={
    "Authorization": "Bearer " + os.environ["BEARER_TOKEN"]})
try:
    with urllib.request.urlopen(req, timeout=30) as r:
        print(r.status, json.load(r)["data"])
except urllib.error.HTTPError as e:
    print(e.code, json.load(e).get("detail"))

We ran it on 26 October 2026 with Python 3.12 and a made-up token. It printed X's real answer:

401 Unauthorized

With a working token, you get a 200 and the account's id, name and username, per X's quickstart. That user read costs you $0.010, as of October 2026.

Step 4: Mint a bearer token with your API key and secret

Or mint the token yourself, with this call from X's bearer token page:

curl -u "$API_KEY:$API_SECRET_KEY" \
  --data 'grant_type=client_credentials' \
  'https://api.x.com/oauth2/token'

X's reply puts your token in access_token, with token_type set to bearer. Its API reference adds two rules:

  • One token per app. Asking again returns "the same already-existent token until it has been invalidated."
  • Cache it. Ask too often, or with a bad key, and X answers 403 with code 99. Our made-up keys got exactly that: "Unable to verify your credentials."

Which X API endpoints accept a bearer token?

Most public reads do, and private user data like DMs never does. We counted the 240 operations that need auth in X's OpenAPI file, version 2.172:

88operations accept a bearer token
152need a user token instead
450recent searches per 15 minutes, per app
Job Endpoint Bearer token?
Look up a user GET /2/users/by/username/{username} Yes
Search recent posts GET /2/tweets/search/recent Yes
Read a user's posts GET /2/users/{id}/tweets Yes
List followers GET /2/users/{id}/followers Yes
Check your credits GET /2/usage/credits Yes
Search for accounts GET /2/users/search No, needs a user
Read your bookmarks GET /2/users/{id}/bookmarks No, needs a user
Create a post POST /2/tweets No, needs a user

You need a user token for anything private or done as an account, and our X API OAuth 2.0 guide sets one up.

Bearer tokens get their own per-app rate limits, listed in our X API rate limits guide.

How to regenerate or revoke an X API bearer token

Regenerate your token as soon as it leaks, in a commit, a screenshot or a chat.

  1. Open your app's Keys and tokens tab in the Developer Console.
  2. Click Regenerate next to the token, as X's best-practices page shows. X's OAuth 2.0 page also mentions a revoke link there.
  3. Copy the new token. Regenerating "invalidates the old ones," says X's getting-access page.
  4. Update every script, then check your usage for calls you didn't make.

X also documents POST oauth2/invalidate_token, but its pages disagree on how to sign that call. The Console button is simpler.

If your X API bearer token doesn't work: 401 vs 403

X's error page draws the line. A 401 is "Invalid or missing authentication credentials," and a 403 is "Valid auth but no permission for this resource or action."

Our tests on 26 October 2026 showed one more rule: X checks whether an endpoint takes app-only auth before it checks the token. So our made-up token got a 403 on /2/users/me. X's answer, trimmed:

{
  "title": "Unsupported Authentication",
  "detail": "Authenticating with OAuth 2.0 Application-Only is forbidden for this endpoint.  Supported authentication types are [OAuth 1.0a User Context, OAuth 2.0 User Context].",
  "status": 403
}

On the user lookup, the same token got a 401 with "detail": "Unauthorized".

  • 401 Unauthorized: your token is wrong, old or missing. We also got 401s for a header without the word Bearer, and for single quotes around $BEARER_TOKEN.
  • 403 Unsupported Authentication: you need a user token for that endpoint. We got the same 403 from POST /2/tweets, so a bearer token can't post.
  • 403 client-forbidden or client-not-enrolled: your app lacks access. X's MCP guide says to move it to Pay-per-use and Production.
  • Calls fail at a $0 balance: buy credits, as our X API 402 guide shows.

Skip the token: read public X data through Weir instead

Only reading public data? You can skip X's app and token. We run Weir, a read-only API and MCP server for public X data, so weigh this section knowing that.

Weir needs no X developer account and no X token. Your Weir key comes with 5,000 free credits a month and no card, and AI agents can sign in over MCP without one.

curl https://api.weirapp.io/v1/x/users/XDevelopers \
  -H "Authorization: Bearer $WEIR_API_KEY"

That lookup costs 3 credits: 1 for the call and 2 for the profile. Get a free Weir key, and weigh the trade-offs:

  • It only reads. Posting, likes and DMs need X's API and a user token.
  • It isn't X. Weir isn't licensed by X, so access can change.
  • It isn't the cheapest per tweet. TwitterAPI.io lists $0.15 per 1,000 tweets.
  • It's still a key to guard. A leaked Weir key spends your credits too.

FAQ

What is a bearer token in the X API?

It's your app's key for app-only authentication: calls made as the app, not as a user. You send it in an Authorization: Bearer header. It reads public posts, profiles and followers, but it can't post or read DMs.

How do I get a Twitter API bearer token?

Sign in to X's developer portal, now the Developer Console at console.x.com. Create an app and copy the Bearer Token X shows you once. Lost it? Generate a new one on the app's Keys and tokens tab, or mint one from your API key and secret at POST /oauth2/token.

Does an X API bearer token expire?

X lists no expiry time. Its token endpoint returns the same token "until it has been invalidated," which happens when you regenerate or revoke it. So alert on a 401 rather than retrying.

Sources

All checked on 26 October 2026:

Keep reading