How do you use multiple X accounts with one API key?
Last updated August 3, 2026
Separate the two things people conflate. One credential handles billing and identifies your integration. Acting as a particular account is a second layer: you supply that account's X session, either registered ahead of time or passed per request. Because the session travels on the call, a single key can drive many accounts, each isolated, at $0.0008 per standard call.
Every rate here is the pricing TwitterAPIs publishes, $0.0008 per call and $0.04 per 1,000 tweets (source: twitterapis.com/pricing).
Why does the official model make this so awkward?
Because the application, not the person, is the container. Credentials belong to an application, while the right to act as somebody is a separate authorisation attached on top. Adding a second account therefore means running a second authorisation, not creating a second application, which is exactly backwards from how most people first read the developer console and why the console appears to offer no way to add one.
What are the two layers here?
The credential and the session, and they answer different questions. The credential answers who is paying and which integration is calling, and it never changes. The session answers whose mailbox and whose timeline this particular call touches, and it changes freely. Keeping them separate is what lets one integration serve many accounts without any of them sharing state.
Should the session be registered or passed per request?
It depends on how many accounts are in play. Registering pins one account as the default, which is simplest when a service acts as itself, and the stored session is held encrypted at rest with AES-256-GCM until replaced. Passing the session on each call stores nothing at all and is the right shape for a multi-account service, because the account is chosen per call rather than per deployment.
How do you keep accounts isolated?
Hold each account's session in your own store, keyed by whichever account identifier your product already uses, and attach the right one as each call goes out. Nothing is shared between them at the platform layer, so one account's session cannot reach another account's messages. A call that reaches for something outside the supplied session is rejected rather than served.
Do public reads need a session at all?
No, and this is where most of the volume usually sits. Reading public timelines, followers, or search results needs only the credential, so a product that mostly observes accounts does not need any session for that work. Sessions are required for the private and write-side calls, which lets you keep the session surface as small as the feature actually demands.
What each layer is responsible for
| Concern | The credential | The session |
|---|---|---|
| Answers | Who pays and which integration calls | Which account this call acts as |
| How many | One for the whole integration | One per account you act as |
| Where it lives | Your server configuration | Registered, or attached per request |
| If registered | Not applicable | Encrypted at rest until replaced |
| If passed per call | Not applicable | Never stored |
Apps are containers for your API credentials.
Questions and answers
- Can one credential act as several accounts?
- Yes, because the account is chosen by the session travelling with each call rather than by the credential. The credential stays fixed for the whole integration, and swapping which session is attached swaps which account the call acts as.
- Do you need a separate integration per account?
- No. That assumption is what makes the official console feel like a dead end. One integration is enough, and each additional account is an additional authorisation attached to calls, not a second set of credentials to obtain and reconcile.
- Is it better to register a session or pass one per call?
- Register when the service acts as itself and one account covers everything. Pass per call when many accounts are in play: nothing is stored, and the account is selected per request rather than fixed at deployment time, which is what a multi-account product needs.
- Where should account sessions be stored?
- In your own store, keyed by whatever account identifier your product already uses, and attached as each call goes out. Registered sessions are held encrypted at rest with AES-256-GCM until replaced, while sessions supplied per call are never stored at all.
- Can one account reach another account's data?
- No. A call reaches only what the supplied session is entitled to, and reaching outside it is rejected rather than served. Isolation follows from the session attached to the call, so accounts do not share state with one another.
- Do public reads need a session per account?
- No. Public timelines, followers and search results need only the credential, so the bulk of read volume needs no session at all. Sessions are needed for private reads and write actions, which keeps the number of stored sessions as small as the feature requires.
Keep reading
Start with $0.50 in free credits
No credit card. Roughly 12,500 tweets to test every endpoint.