CARVIEW |
Select Language
HTTP/2 301
date: Thu, 31 Jul 2025 03:39:07 GMT
content-type: text/html; charset=iso-8859-1
location: https://developer.x.com/en/docs/authentication/oauth-2-0
perf: 7402827104
set-cookie: guest_id_marketing=v1%3A175393314717283458; Max-Age=63072000; Expires=Sat, 31 Jul 2027 03:39:07 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None
cache-control: no-cache, no-store, max-age=0
x-transaction-id: f3cd25acf7bcb589
x-xss-protection: 0
strict-transport-security: max-age=631138519; includeSubdomains
x-response-time: 6
x-connection-hash: 400d739a8fc705a5a7becceb1a739f267bf473a6850b7ecdd8848b8b2eaebeb8
vary: accept-encoding
cf-cache-status: DYNAMIC
set-cookie: guest_id_ads=v1%3A175393314717283458; Max-Age=63072000; Expires=Sat, 31 Jul 2027 03:39:07 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None
set-cookie: personalization_id="v1_pa0aPM1KpLPo9FxWE5Ks5w=="; Max-Age=63072000; Expires=Sat, 31 Jul 2027 03:39:07 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None
set-cookie: guest_id=v1%3A175393314717283458; Max-Age=63072000; Expires=Sat, 31 Jul 2027 03:39:07 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None
set-cookie: __cf_bm=PwePzgeoNH6zDPsXqSfANcCRxTtOliNBj7uTd_OSYj4-1753933147-1.0.1.1-j5HOGlwtCKcY9e8XPDqriak9.Q1unYhlYil4WD2seF.DvcTj_LE0B1CI8ETxiKAWfwKG5PcvODWRHwanfjq.n9G.W1LylvIZP3TlLbY2bGo; path=/; expires=Thu, 31-Jul-25 04:09:07 GMT; domain=.twitter.com; HttpOnly; Secure; SameSite=None
server: cloudflare tsa_p
cf-ray: 967a1118e846a8b0-BLR
HTTP/2 302
date: Thu, 31 Jul 2025 03:39:07 GMT
content-type: text/html
location: https://docs.x.com/resources/fundamentals/authentication/oauth-2-0/overview
perf: 7402827104
vary: Cookie,X-Twitter-Internal,X-Twitter-IP-Tags
pragma: no-cache
expires: 0
set-cookie: guest_id_marketing=v1%3A175393314748069989; Max-Age=63072000; Expires=Sat, 31 Jul 2027 03:39:07 GMT; Path=/; Domain=.x.com; Secure; SameSite=None
cache-control: no-cache, no-store, max-age=0 must-revalidate
x-frame-options: SAMEORIGIN
x-transaction-id: b6fd62527de8d8f3
x-xss-protection: 0
x-content-type-options: nosniff
content-security-policy: default-src 'self' ; connect-src 'self' https://*.twimg.com https://*.twitter.com https://*.x.com https://syndication.twitter.com https://*.analytics.google.com https://*.g.doubleclick.net https://*.google-analytics.com https://*.googletagmanager.com https://analytics.google.com https://google.com https://pagead2.googlesyndication.com https://www.google.com https://www.googleadservices.com https://api.meetup.com https://s1259914507.t.eloqua.com; font-src 'self' https://*.twimg.com https://*.twitter.com https://*.x.com https://cdn.cms-twdigitalassets.com https://fonts.googleapis.com https://fonts.gstatic.com data:; frame-src 'self' https://twitter.com https://x.com https://*.twitter.com https://*.x.com https://td.doubleclick.net https://www.googletagmanager.com https://iframe.arkoselabs.com https://www.gstatic.com https://www.google.com https://docs.google.com https://www.youtube.com https://glitch.com https://trello.com; img-src 'self' https://*.twimg.com https://*.twitter.com https://*.x.com https://twitter.com https://x.com https://t.co https://cdn.cms-twdigitalassets.com https://www.googletagmanager.com https://googleads.g.doubleclick.net https://pagead2.googlesyndication.com https://*.google-analytics.com https://*.googletagmanager.com https://www.google.com https://www.google.ad https://www.google.ae https://www.google.com.af https://www.google.com.ag https://www.google.al https://www.google.am https://www.google.co.ao https://www.google.com.ar https://www.google.as https://www.google.at https://www.google.com.au https://www.google.az https://www.google.ba https://www.google.com.bd https://www.google.be https://www.google.bf https://www.google.bg https://www.google.com.bh https://www.google.bi https://www.google.bj https://www.google.com.bn https://www.google.com.bo https://www.google.com.br https://www.google.bs https://www.google.bt https://www.google.co.bw https://www.google.by https://www.google.com.bz https://www.google.ca https://www.google.cd https://www.google.cf https://www.google.cg https://www.google.ch https://www.google.ci https://www.google.co.ck https://www.google.cl https://www.google.cm https://www.google.cn https://www.google.com.co https://www.google.co.cr https://www.google.com.cu https://www.google.cv https://www.google.com.cy https://www.google.cz https://www.google.de https://www.google.dj https://www.google.dk https://www.google.dm https://www.google.com.do https://www.google.dz https://www.google.com.ec https://www.google.ee https://www.google.com.eg https://www.google.es https://www.google.com.et https://www.google.fi https://www.google.com.fj https://www.google.fm https://www.google.fr https://www.google.ga https://www.google.ge https://www.google.gg https://www.google.com.gh https://www.google.com.gi https://www.google.gl https://www.google.gm https://www.google.gr https://www.google.com.gt https://www.google.gy https://www.google.com.hk https://www.google.hn https://www.google.hr https://www.google.ht https://www.google.hu https://www.google.co.id https://www.google.ie https://www.google.co.il https://www.google.im https://www.google.co.in https://www.google.iq https://www.google.is https://www.google.it https://www.google.je https://www.google.com.jm https://www.google.jo https://www.google.co.jp https://www.google.co.ke https://www.google.com.kh https://www.google.ki https://www.google.kg https://www.google.co.kr https://www.google.com.kw https://www.google.kz https://www.google.la https://www.google.com.lb https://www.google.li https://www.google.lk https://www.google.co.ls https://www.google.lt https://www.google.lu https://www.google.lv https://www.google.com.ly https://www.google.co.ma https://www.google.md https://www.google.me https://www.google.mg https://www.google.mk https://www.google.ml https://www.google.com.mm https://www.google.mn https://www.google.com.mt https://www.google.mu https://www.google.mv https://www.google.mw https://www.google.com.mx https://www.google.com.my https://www.google.co.mz https://www.google.com.na https://www.google.com.ng https://www.google.com.ni https://www.google.ne https://www.google.nl https://www.google.no https://www.google.com.np https://www.google.nr https://www.google.nu https://www.google.co.nz https://www.google.com.om https://www.google.com.pa https://www.google.com.pe https://www.google.com.pg https://www.google.com.ph https://www.google.com.pk https://www.google.pl https://www.google.pn https://www.google.com.pr https://www.google.ps https://www.google.pt https://www.google.com.py https://www.google.com.qa https://www.google.ro https://www.google.ru https://www.google.rw https://www.google.com.sa https://www.google.com.sb https://www.google.sc https://www.google.se https://www.google.com.sg https://www.google.sh https://www.google.si https://www.google.sk https://www.google.com.sl https://www.google.sn https://www.google.so https://www.google.sm https://www.google.sr https://www.google.st https://www.google.com.sv https://www.google.td https://www.google.tg https://www.google.co.th https://www.google.com.tj https://www.google.tl https://www.google.tm https://www.google.tn https://www.google.to https://www.google.com.tr https://www.google.tt https://www.google.com.tw https://www.google.co.tz https://www.google.com.ua https://www.google.co.ug https://www.google.co.uk https://www.google.com.uy https://www.google.co.uz https://www.google.com.vc https://www.google.co.ve https://www.google.co.vi https://www.google.com.vn https://www.google.vu https://www.google.ws https://www.google.rs https://www.google.co.za https://www.google.co.zm https://www.google.co.zw https://www.google.cat https://google.com https://google.ad https://google.ae https://google.com.af https://google.com.ag https://google.al https://google.am https://google.co.ao https://google.com.ar https://google.as https://google.at https://google.com.au https://google.az https://google.ba https://google.com.bd https://google.be https://google.bf https://google.bg https://google.com.bh https://google.bi https://google.bj https://google.com.bn https://google.com.bo https://google.com.br https://google.bs https://google.bt https://google.co.bw https://google.by https://google.com.bz https://google.ca https://google.cd https://google.cf https://google.cg https://google.ch https://google.ci https://google.co.ck https://google.cl https://google.cm https://google.cn https://google.com.co https://google.co.cr https://google.com.cu https://google.cv https://google.com.cy https://google.cz https://google.de https://google.dj https://google.dk https://google.dm https://google.com.do https://google.dz https://google.com.ec https://google.ee https://google.com.eg https://google.es https://google.com.et https://google.fi https://google.com.fj https://google.fm https://google.fr https://google.ga https://google.ge https://google.gg https://google.com.gh https://google.com.gi https://google.gl https://google.gm https://google.gr https://google.com.gt https://google.gy https://google.com.hk https://google.hn https://google.hr https://google.ht https://google.hu https://google.co.id https://google.ie https://google.co.il https://google.im https://google.co.in https://google.iq https://google.is https://google.it https://google.je https://google.com.jm https://google.jo https://google.co.jp https://google.co.ke https://google.com.kh https://google.ki https://google.kg https://google.co.kr https://google.com.kw https://google.kz https://google.la https://google.com.lb https://google.li https://google.lk https://google.co.ls https://google.lt https://google.lu https://google.lv https://google.com.ly https://google.co.ma https://google.md https://google.me https://google.mg https://google.mk https://google.ml https://google.com.mm https://google.mn https://google.com.mt https://google.mu https://google.mv https://google.mw https://google.com.mx https://google.com.my https://google.co.mz https://google.com.na https://google.com.ng https://google.com.ni https://google.ne https://google.nl https://google.no https://google.com.np https://google.nr https://google.nu https://google.co.nz https://google.com.om https://google.com.pa https://google.com.pe https://google.com.pg https://google.com.ph https://google.com.pk https://google.pl https://google.pn https://google.com.pr https://google.ps https://google.pt https://google.com.py https://google.com.qa https://google.ro https://google.ru https://google.rw https://google.com.sa https://google.com.sb https://google.sc https://google.se https://google.com.sg https://google.sh https://google.si https://google.sk https://google.com.sl https://google.sn https://google.so https://google.sm https://google.sr https://google.st https://google.com.sv https://google.td https://google.tg https://google.co.th https://google.com.tj https://google.tl https://google.tm https://google.tn https://google.to https://google.com.tr https://google.tt https://google.com.tw https://google.co.tz https://google.com.ua https://google.co.ug https://google.co.uk https://google.com.uy https://google.co.uz https://google.com.vc https://google.co.ve https://google.co.vi https://google.com.vn https://google.vu https://google.ws https://google.rs https://google.co.za https://google.co.zm https://google.co.zw https://google.cat https://www.google.com/pagead/1p-user-list/780419404/ https://maps.googleapis.com https://s1259914507.t.eloqua.com https://px.ads.linkedin.com https://p.adsymptotic.com/d/px https://maps.gstatic.com https://udc-neb.kampyle.com/ data:; media-src 'self' https://*.twimg.com https://*.twitter.com https://*.x.com https://cdn.cms-twdigitalassets.com; object-src 'self' ; script-src 'self' https://*.twimg.com https://*.twitter.com https://*.x.com https://cdn.cms-twdigitalassets.com https://static.ads-twitter.com 'sha256-9G5TwxImuKFNB+uY9x5+mjMfXDSza+S1DEsjxK1xeWw=' https://*.googletagmanager.com https://googleads.g.doubleclick.net https://pagead2.googlesyndication.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com https://api.meetup.com; style-src 'self' 'unsafe-inline' https://*.twimg.com https://*.twitter.com https://*.x.com https://cdn.cms-twdigitalassets.com https://fonts.googleapis.com; report-uri https://twitter.com/i/csp_report https://x.com/i/csp_report; frame-ancestors 'self' https://docs.x.com https://x-preview.mintlify.app https://localhost:3000 https://localhost:3000
strict-transport-security: max-age=631138519; includeSubdomains
x-response-time: 13
x-connection-hash: 055fa419ef635294d8876502dfb12130e9c39bd7aca462484d7082031a77e10f
cf-cache-status: DYNAMIC
set-cookie: guest_id_ads=v1%3A175393314748069989; Max-Age=63072000; Expires=Sat, 31 Jul 2027 03:39:07 GMT; Path=/; Domain=.x.com; Secure; SameSite=None
set-cookie: personalization_id="v1_N1p3SNqNEUT/wJkNz0WxGA=="; Max-Age=63072000; Expires=Sat, 31 Jul 2027 03:39:07 GMT; Path=/; Domain=.x.com; Secure; SameSite=None
set-cookie: guest_id=v1%3A175393314748069989; Max-Age=63072000; Expires=Sat, 31 Jul 2027 03:39:07 GMT; Path=/; Domain=.x.com; Secure; SameSite=None
set-cookie: ct0=408765714ea135ed0c1e0ee41fff1542; Max-Age=21600; Expires=Thu, 31 Jul 2025 09:39:07 GMT; Path=/; Domain=.x.com; Secure
set-cookie: __cf_bm=Jz2yxPj9wg3DtU3xOaspsN9VAEqKTgMqu06TaIMPPow-1753933147-1.0.1.1-ZFbjxNpotyJME5sI7EiMaz.OosvP8gz5JLBghUaq9okGiO7xCryYv97eBVdG.sBW15JGkZgs5AMVkvR5z8vxsjUwJzwN_W4dxaZ..dcJCaU; path=/; expires=Thu, 31-Jul-25 04:09:07 GMT; domain=.x.com; HttpOnly; Secure; SameSite=None
server: cloudflare tsa_b
cf-ray: 967a111ac83e3c3a-BOM
HTTP/2 307
age: 10106
cache-control: public, max-age=0, must-revalidate
content-security-policy: worker-src * blob: data: 'unsafe-eval' 'unsafe-inline'; object-src data: ; base-uri 'self'; form-action 'self' https://codesandbox.io; upgrade-insecure-requests; frame-ancestors 'none';
content-type: text/html; charset=utf-8
date: Thu, 31 Jul 2025 00:50:41 GMT
etag: "zenoontirk2r80"
location: /fundamentals/authentication/oauth-2-0/overview
server: Vercel
strict-transport-security: max-age=63072000
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch
x-frame-options: DENY
x-matched-path: /_sites/[subdomain]/[[...slug]]
x-nextjs-prerender: 1
x-nextjs-stale-time: 60
x-powered-by: Next.js
x-vercel-cache: HIT
x-vercel-id: bom1::iad1::fp49r-1753933147673-e18d649616f9
content-length: 128608
HTTP/2 200
age: 10104
cache-control: public, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: worker-src * blob: data: 'unsafe-eval' 'unsafe-inline'; object-src data: ; base-uri 'self'; form-action 'self' https://codesandbox.io; upgrade-insecure-requests; frame-ancestors 'none';
content-type: text/html; charset=utf-8
date: Thu, 31 Jul 2025 00:50:44 GMT
etag: W/"5cv6l6dcwx7hkp"
server: Vercel
strict-transport-security: max-age=63072000
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch
x-frame-options: DENY
x-matched-path: /_sites/[subdomain]/[[...slug]]
x-nextjs-prerender: 1
x-nextjs-stale-time: 60
x-powered-by: Next.js
x-vercel-cache: HIT
x-vercel-id: bom1::iad1::hghwh-1753933148034-add356068ac2
OAuth 2.0 - X Developer Portal Forums GitHub
API calls using app-only authentication are rate limited per endpoint at the App level.
To use this method, you’ll need a Bearer Token, which you can generate by passing your API Key and Secret through the POST oauth2/token endpoint, or by generating it in the “keys and token” section of your App settings in the developer portal.
If you’d like to revoke a Bearer Token, you can use the POST oauth2/invalidate_token endpoint, or click where it says “revoke” next to the Bearer Token in the “keys and tokens” section of your App settings.
Getting Started
Fundamentals
Partners & Customers
- Partner Directory
- Customer Directory
- Request Access
OAuth 2.0
OAuth 2.0
Bearer Token (also known as app-only)
OAuth 2.0 Bearer Token authenticates requests on behalf of your developer App. As this method is specific to the App, it does not involve any users. This method is typically for developers that need read-only access to public information. This authentication method requires for you to pass a Bearer Token with your request, which you can generate within the Keys and tokens section of your developer Apps. Here is an example of what a request looks like with a fake Bearer Token:Copy
Ask AI
curl "https://api.x.com/2/tweets?ids=1261326399320715264,1278347468690915330" \
-H "Authorization: Bearer AAAAAAAAAAAAAAAAAAAAAFnz2wAAAAAAxTmQbp%2BIHDtAhTBbyNJon%2BA72K4%3DeIaigY0QBrv6Rp8KZQQLOTpo9ubw5Jt?WRE8avbi"
OAuth 2.0 Authorization Code Flow with PKCE
OAuth 2.0 Authorization Code Flow with PKCE allows you to authenticate on behalf of another user with have more control over an application’s scopes and improves authorization flows across multiple devices. In other words, developers building applications for people on X will have more control over the information their App requests from its users, so that you only have to ask your end-users for the data and information you need. This modern authorization protocol will allow you to present your end-users with a more streamlined consent flow for authorizing your app, which only displays the specific scopes you have requested from them. Not only does this reduce your data burden, but it may also lead to increased trust from end-users.Assistant
Responses are generated using AI and may contain mistakes.