What is an X API key?
Last updated August 3, 2026
An X API key is the credential that identifies your application to the platform. On X itself it is not one value but a family of four, split across two OAuth generations, and issuing them requires an approved developer account. TwitterAPIs replaces that family with a single bearer credential that arrives in about 30 seconds with $0.50 of credit attached.
Every rate here is the pricing TwitterAPIs publishes, $0.0008 per call and $0.04 per 1,000 tweets (source: twitterapis.com/pricing).
Why is there more than one kind of X credential?
Because different calls need to prove different things. A bearer token proves an application is making the call and suits read-only work. A consumer key and secret pair belongs to the older OAuth generation and is still what some legacy paths expect. A client id and secret drives a browser sign-in flow. An access token and secret proves a specific person authorised the action, which is what posting or liking requires.
Where do the official credentials come from?
From an approved developer account, and approval is the slow part. The path runs through a developer application that asks for a written description of the intended use, then a card on file, before any of the values are issued. Only after that does the console expose the key family for an application. The wait is measured in hours or days rather than minutes.
What replaces that family here?
One value, sent as a bearer credential in a request header on every endpoint. There is no consumer secret to pair it with, no browser redirect to complete, and no separate token for each generation of the protocol. The same credential covers reads across the whole surface, which is the difference between wiring one header and reconciling four values across two protocols.
When does one credential stop being enough?
When a call has to act as an account rather than observe public data. Reads of public material need only the key. Private reads and write actions additionally need an X session, either registered once and held encrypted at rest with AES-256-GCM until replaced, or handed over per request and never stored. That session sits alongside the key, it does not replace it.
What does a new credential start with?
$0.50 in credit and no card requirement. At the standard rate that is roughly 625 calls, in the region of 12,500 posts, which is enough to exercise the surface properly before any money changes hands. Registration is by Google or email and takes about half a minute, so the credential exists before a developer application would have been read.
One credential against the official family
| Question | Official X API | TwitterAPIs |
|---|---|---|
| How many values | Four, across two OAuth generations | One bearer credential |
| What is required first | An approved developer account and a written use case | An email or Google sign-in |
| Card on file | Required before issue | Not required |
| Time to first call | Hours to days | About 30 seconds |
| Starting balance | None | $0.50 in credit |
You can get your App's API Keys, App-only Access Token, personal Access Token, and Access Token Secret from the X developer Apps section in the Developer Console.
Questions and answers
- Is an X API key a single value?
- On X, no. It is a family of four values spread across two OAuth generations, and which ones a call needs depends on whether it acts as an application or as a person. Here it is genuinely one value, sent as a bearer credential in a header.
- Do you need a developer account to get one?
- For the official credentials, yes, and that approval is the slow step: a written description of intended use and a card on file come before any value is issued. A TwitterAPIs credential needs neither and is issued on sign-up.
- How is the credential sent on a request?
- As a bearer credential in a request header, on every endpoint, with no signing step and no secret to pair with it. There is no browser redirect to complete first, which is what makes it usable from a script or a scheduled job with no interactive step.
- What is the difference between a bearer token and an access token?
- A bearer token proves an application is calling and suits reading public material. An access token and its secret prove a specific person authorised the action, which is what posting, liking or following requires. The two answer different questions and are not interchangeable.
- Does the key alone allow write actions?
- No. Public reads run on the credential alone, but acting as an account also needs an X session, either registered once and held encrypted at rest with AES-256-GCM, or supplied per request and never stored. The session accompanies the key rather than replacing it.
- What does a new credential come with?
- $0.50 in credit and no card requirement, which is roughly 625 calls or in the region of 12,500 posts at the standard rate. Sign-up is by Google or email and takes about half a minute, so testing can start immediately.
Keep reading
Start with $0.50 in free credits
No credit card. Roughly 12,500 tweets to test every endpoint.