X · OAuth Scopes

X OAuth Scopes

OAuth 2.0 searched

X publishes 29 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the X API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

SocialSocial-MediaPostsUserDirect MessagesStreamingWebhookReal-TimeTrendsMediaSpacesContentConversationAgentsMCP

Scopes: 29 Flows: Method: searched

Scopes (29)

Scope	Description	Flows
ads.read
ads.write
block.read	View accounts you have blocked.
block.write	Block and unblock accounts on your behalf.
bookmark.read	Read your bookmarked Posts.
bookmark.write	Create and delete your bookmarks.
broadcast.read	View your live broadcasts and their chat.
broadcast.write	Manage your live broadcasts and send chat messages on your behalf.
developer.billing.write
developer.read	View your developer accounts, apps, and settings.
developer.write	Create and manage your X Developer Platform account.
dm.read	Read all your Direct Messages.
dm.write	Send and manage your Direct Messages.
follows.read	View accounts you follow and accounts following you.
follows.write	Follow and unfollow accounts on your behalf.
like.read	View Posts you have liked and likes you can see.
like.write	Like and unlike Posts on your behalf.
list.read	View Lists, members, and followers of Lists you created or are a member of, including private Lists.
list.write	Create and manage Lists on your behalf.
media.write	Upload media, such as photos and videos, on your behalf.
mute.read	View accounts you have muted.
mute.write	Mute and unmute accounts on your behalf.
offline.access	Request a refresh token for the app.
space.read	View all Spaces you have access to.
timeline.read	View all Custom Timelines you can see.
tweet.moderate.write	Hide and unhide replies to your posts.
tweet.read	View all posts you can see, including those from protected accounts.
tweet.write	Create and repost on your behalf.
users.read	View any account you can see, including protected accounts.

📄 Provider scope reference: https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code

Source

OAuth Scopes

generated: '2026-08-28'
method: searched
source: openapi/_original/x-api-v2-openapi.json, https://api.x.com/.well-known/oauth-authorization-server,
  https://api.x.com/.well-known/oauth-protected-resource
docs: https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code
description: 'OAuth 2.0 scopes for the X API v2, reconciled across three authoritative sources X publishes:
  the securitySchemes block of its own OpenAPI, the RFC 8414 authorization server metadata at api.x.com,
  and the RFC 9728 protected-resource metadata that governs the hosted MCP server. The three lists DISAGREE,
  and the disagreement is recorded per scope rather than flattened.'
flow:
  type: authorizationCode
  pkce: S256
  authorizationUrl: https://x.com/i/oauth2/authorize
  authorizationUrl_in_spec: https://api.x.com/2/oauth2/authorize
  tokenUrl: https://api.x.com/2/oauth2/token
  issuer: https://api.x.com
  grant_types:
  - authorization_code
  - refresh_token
  token_endpoint_auth_methods:
  - none
  - client_secret_basic
  dynamic_client_registration: false
  note: The spec names https://api.x.com/2/oauth2/authorize while the authorization server metadata names
    https://x.com/i/oauth2/authorize. Both are published by X; the well-known document is the RFC 8414
    authority for the running server.
counts:
  in_spec: 26
  advertised_by_authorization_server: 18
  mcp_resource_scopes: 15
  union: 29
  spec_only:
  - broadcast.read
  - broadcast.write
  - developer.read
  - dm.read
  - dm.write
  - follows.write
  - like.write
  - mute.write
  - timeline.read
  - tweet.moderate.write
  - tweet.write
  server_only:
  - ads.read
  - ads.write
  - developer.billing.write
reconciliation_note: Eleven scopes appear in the contract but are NOT advertised by the authorization
  server (most of the .write family plus dm.read/dm.write, timeline.read, tweet.write, tweet.moderate.write,
  media.write, broadcast.*). Three appear only in the server metadata (ads.read, ads.write, developer.billing.write).
  An agent that builds its consent screen from the well-known document alone will be missing write scopes
  the API requires.
scopes:
- scope: ads.read
  description: null
  in_spec: false
  advertised_by_authorization_server: true
  mcp_resource_scope: false
  access: read
- scope: ads.write
  description: null
  in_spec: false
  advertised_by_authorization_server: true
  mcp_resource_scope: false
  access: write
- scope: block.read
  description: View accounts you have blocked.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: read
- scope: block.write
  description: Block and unblock accounts on your behalf.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: write
- scope: bookmark.read
  description: Read your bookmarked Posts.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: read
- scope: bookmark.write
  description: Create and delete your bookmarks.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: write
- scope: broadcast.read
  description: View your live broadcasts and their chat.
  in_spec: true
  advertised_by_authorization_server: false
  mcp_resource_scope: false
  access: read
- scope: broadcast.write
  description: Manage your live broadcasts and send chat messages on your behalf.
  in_spec: true
  advertised_by_authorization_server: false
  mcp_resource_scope: false
  access: write
- scope: developer.billing.write
  description: null
  in_spec: false
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: write
- scope: developer.read
  description: View your developer accounts, apps, and settings.
  in_spec: true
  advertised_by_authorization_server: false
  mcp_resource_scope: false
  access: read
- scope: developer.write
  description: Create and manage your X Developer Platform account.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: write
- scope: dm.read
  description: Read all your Direct Messages.
  in_spec: true
  advertised_by_authorization_server: false
  mcp_resource_scope: false
  access: read
- scope: dm.write
  description: Send and manage your Direct Messages.
  in_spec: true
  advertised_by_authorization_server: false
  mcp_resource_scope: false
  access: write
- scope: follows.read
  description: View accounts you follow and accounts following you.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: read
- scope: follows.write
  description: Follow and unfollow accounts on your behalf.
  in_spec: true
  advertised_by_authorization_server: false
  mcp_resource_scope: false
  access: write
- scope: like.read
  description: View Posts you have liked and likes you can see.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: read
- scope: like.write
  description: Like and unlike Posts on your behalf.
  in_spec: true
  advertised_by_authorization_server: false
  mcp_resource_scope: false
  access: write
- scope: list.read
  description: View Lists, members, and followers of Lists you created or are a member of, including private
    Lists.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: read
- scope: list.write
  description: Create and manage Lists on your behalf.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: write
- scope: media.write
  description: Upload media, such as photos and videos, on your behalf.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: false
  access: write
- scope: mute.read
  description: View accounts you have muted.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: read
- scope: mute.write
  description: Mute and unmute accounts on your behalf.
  in_spec: true
  advertised_by_authorization_server: false
  mcp_resource_scope: false
  access: write
- scope: offline.access
  description: Request a refresh token for the app.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: other
- scope: space.read
  description: View all Spaces you have access to.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: read
- scope: timeline.read
  description: View all Custom Timelines you can see.
  in_spec: true
  advertised_by_authorization_server: false
  mcp_resource_scope: false
  access: read
- scope: tweet.moderate.write
  description: Hide and unhide replies to your posts.
  in_spec: true
  advertised_by_authorization_server: false
  mcp_resource_scope: false
  access: write
- scope: tweet.read
  description: View all posts you can see, including those from protected accounts.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: read
- scope: tweet.write
  description: Create and repost on your behalf.
  in_spec: true
  advertised_by_authorization_server: false
  mcp_resource_scope: false
  access: write
- scope: users.read
  description: View any account you can see, including protected accounts.
  in_spec: true
  advertised_by_authorization_server: true
  mcp_resource_scope: true
  access: read

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this

find_scopesBrowse and filter every scope set in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This scope set

curl "https://apis.io/api/v1/scopes/x-scopes"

All oauth scopes

curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.