How to get an X API key (and when you don't need one)

To get an X API key, sign in at console.x.com with your X account, accept the Developer Agreement, create a new app, and copy the credentials it generates: API Key and Secret, Bearer Token, Access Token and Secret, and an OAuth 2.0 Client ID and Secret. The key is free. Using it is pay-per-use, billed against credits you buy upfront.

This post covers the steps as X documents them today, what each credential is for, what requests cost, and when you don't need your own X API key at all. We checked every X step and price on docs.x.com on 2026-10-14.

How to get an X API key, step by step

X's Getting Access guide has three steps.

1. Create a developer account. Sign in to the Developer Console at console.x.com with your X account. Review and accept the Developer Agreement and Policy, then "Provide basic information about how you'll use the API." Describe your use case specifically.

2. Create an app. Click New App on the console dashboard and enter a name, description and use case. The console then generates your credentials.

3. Save your credentials. X's guide warns in bold: "Save immediately. Credentials are only displayed once." If you lose them you have to regenerate them, which invalidates the old ones. Keep them in a password manager or an environment variable, never in git.

Next, make a test call. This is the first request in X's own quickstart:

curl "https://api.x.com/2/users/by/username/xdevelopers" \
  -H "Authorization: Bearer $BEARER_TOKEN"

A response with the XDevelopers profile means your key works. According to X's guide, a 403 can mean your app doesn't have access to that endpoint.

Which X API credential does what

The console gives you four pairs of things, and the names confuse almost everyone the first time.

In short, reading public data takes the Bearer Token. Acting as a user (posting, liking, sending DMs) takes user-context auth with OAuth 1.0a or OAuth 2.0. People search for a "twitter api key" when what they usually need is the Bearer Token.

Know one rule before you paste your key anywhere. X's Developer Agreement (last updated April 27, 2026) says you "will not make available to any third party any token, key, password, or other login credentials to the X API." So a SaaS tool that asks for your X API key is asking you to break that rule.

What the X API costs now

X now bills self-serve developers pay-per-use. In May 2026, X's Chris Park wrote that pay-per-use "is now the default way to build with X for self serve developers & agents" (post), and @XDevelopers announced that legacy Basic subscribers "will be automatically migrated to the new Pay-Per-Use plan after June 1, 2026" (post).

X's pricing page sums it up in two phrases: "No subscriptions" and "pay only for what you use." You buy credits upfront in the Developer Console, and each request deducts from them. Some of the listed prices, as of Oct 14, 2026:

The same page lists a few more details. Reads of your own account's data ("Owned Reads") cost $0.001 per resource. Pay-per-use is capped at 3 million post reads per monthly billing cycle, and Enterprise covers anything above that. Resources are deduplicated within a 24-hour UTC window, and you can set spending limits. X also gives $20 in credits when you save your first payment card and matches your first auto-recharge up to $50, which @XDevelopers pitched as "$70 in free credits" (post).

We won't repeat the full pricing breakdown here. XAutoDM has a detailed walkthrough of X API pricing and cheaper alternatives, plus a separate post on whether the Twitter API is free in 2026.

What developers say about pay-per-use

How people reacted depended on what they build. @wholemars saw a door opening: "it's now much easier to build support for X into your applications" (post). Accounts that post a lot got the opposite math. Europe Elects wrote that pay-per-use was "creating cost constraints for organisations like ours" and that it "cannot post consistently on the platform at this time" (post). At $0.200 per post with a link, a news account posting 50 linked updates a day spends about $300 a month just on posting.

Some developers remember worse. @0xDeployer said that before the switch, X "tried to shake us down to pay $50,000 a month" (post). Compared with that, a per-request bill is easier to plan around.

When you don't need an X API key

Getting a key is quick. The ongoing work is everything around it: OAuth flows, keeping credentials secret, watching the credit balance, and adapting when X changes prices or endpoints. If you only need to read public X data, or your product also needs Reddit, a hosted API can be simpler.

ChatterAPI is one option. It reads public X data with its own access, so you don't create an X app or pay X directly. One ChatterAPI key covers both X and Reddit, over REST or a hosted MCP server. ChatterAPI is independent and not affiliated with X Corp.

Below is a user lookup, the same job as X's first-request example. The response is a real sample recorded with a test key (test calls cost nothing), trimmed to the useful fields:

curl "https://api.chatterapi.com/v1/x/users/levelsio" \
  -H "Authorization: Bearer $CHATTERAPI_KEY"

{
  "data": {
    "id": "1577241403",
    "handle": "levelsio",
    "followers": 974707,
    "following": 3276,
    "tweets": 181450,
    "blueVerified": true,
    "canDm": false,
    "createdAt": "2013-07-08T09:31:59.000Z"
  },
  "credits": { "charged": 0, "remaining": 719 },
  "requestId": "req_01M4X1HX40NTY80C1W38",
  "cached": true
}

On a live key, x.user costs 3 credits. Tweet search (x.search), timelines, followers, replies and list members cost 3 credits per page of about 20 results. You can try them without code in the free X user lookup and X tweet search tools. Posting, DMs and other actions run only from X accounts you connect in the dashboard, within safe daily limits.

In Python:

import os, requests

r = requests.get(
    "https://api.chatterapi.com/v1/x/tweets/search",
    headers={"Authorization": f"Bearer {os.environ['CHATTERAPI_KEY']}"},
    params={"q": "from:XDevelopers pay-per-use", "sort": "latest"},
    timeout=60,
)
body = r.json()
for t in body["data"]:
    print(t["createdAt"][:10], t["likes"], t["url"])
print("credits left:", body["credits"]["remaining"])

Your own X API key or a hosted API?

There's a strong case for going direct. X's API is first-party, so it tracks X's own changes and its terms come straight from the platform. If your product depends on X for the long term, a direct relationship protects you from a middleman disappearing or changing prices. Our comparison of the best MCP servers for Reddit and X covers X's own MCP server too, and if MCP is new to you, start with what an MCP server is.

A hosted API makes sense when X is one of several data sources, when your usage is mostly reads, or when you'd rather not manage OAuth. Whichever you pick, read X's terms for your use case, especially if you plan to use X data with AI models. The Developer Agreement prohibits using the X API or X content "to fine-tune or train a foundation or frontier model." For more on why AI tools struggle to read X and Reddit, see why AI can't read Reddit and X.

Try it

ChatterAPI gives your code and your agents Reddit and X data through one key, over REST or MCP, and you don't have to apply for a developer account. Sign up with Google to get 100 free credits with no card, enough for about 33 user lookups or tweet-search pages. Plans start at $19 a month for 25,000 credits.