X · Authentication Profile

X Authentication

Authentication

Authentication profile for the X API v2. Three schemes are declared in X's published contract and all three are documented as first-class methods: app-only Bearer for read-only public data, OAuth 2.0 Authorization Code with PKCE for user context (required for every write), and legacy OAuth 1.0a user context. Enterprise endpoints additionally accept Basic Auth.

X secures its APIs with http and oauth2 across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

SocialSocial-MediaPostsUserDirect MessagesStreamingWebhookReal-TimeTrendsMediaSpacesContentConversationAgentsMCP
Methods: http, oauth2 Schemes: 3 OAuth flows: authorizationCode API key in:

Security Schemes

OAuth2UserToken oauth2
· flows: authorizationCode
BearerToken http
scheme: bearer
UserToken http
scheme: OAuth

Source

Authentication Profile

Raw ↑ 
generated: '2026-08-28'
method: searched
source: https://docs.x.com/fundamentals/authentication/overview + openapi/_original/x-api-v2-openapi.json
summary:
  types:
  - http
  - oauth2
  oauth2_flows:
  - authorizationCode
schemes:
- name: OAuth2UserToken
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.x.com/2/oauth2/authorize
    tokenUrl: https://api.x.com/2/oauth2/token
    scopes: 26
  sources:
  - openapi/x-account-activity-api-openapi.yml
  - openapi/x-account-api-openapi.yml
  - openapi/x-activity-api-openapi.yml
  - openapi/x-articles-api-openapi.yml
  - openapi/x-broadcasts-api-openapi.yml
  - openapi/x-chat-api-openapi.yml
  - openapi/x-communities-api-openapi.yml
  - openapi/x-community-notes-api-openapi.yml
  - openapi/x-direct-messages-api-openapi.yml
  - openapi/x-lists-api-openapi.yml
  - openapi/x-media-api-openapi.yml
  - openapi/x-news-api-openapi.yml
  - openapi/x-posts-api-openapi.yml
  - openapi/x-spaces-api-openapi.yml
  - openapi/x-trends-api-openapi.yml
  - openapi/x-usage-api-openapi.yml
  - openapi/x-users-api-openapi.yml
- name: BearerToken
  type: http
  scheme: bearer
  sources:
  - openapi/x-account-activity-api-openapi.yml
  - openapi/x-activity-api-openapi.yml
  - openapi/x-bots-api-openapi.yml
  - openapi/x-communities-api-openapi.yml
  - openapi/x-compliance-api-openapi.yml
  - openapi/x-connections-api-openapi.yml
  - openapi/x-lists-api-openapi.yml
  - openapi/x-media-api-openapi.yml
  - openapi/x-news-api-openapi.yml
  - openapi/x-posts-api-openapi.yml
  - openapi/x-spaces-api-openapi.yml
  - openapi/x-stream-api-openapi.yml
  - openapi/x-trends-api-openapi.yml
  - openapi/x-usage-api-openapi.yml
  - openapi/x-users-api-openapi.yml
  - openapi/x-webhooks-api-openapi.yml
- name: UserToken
  type: http
  scheme: OAuth
  sources:
  - openapi/x-account-activity-api-openapi.yml
  - openapi/x-activity-api-openapi.yml
  - openapi/x-articles-api-openapi.yml
  - openapi/x-broadcasts-api-openapi.yml
  - openapi/x-chat-api-openapi.yml
  - openapi/x-communities-api-openapi.yml
  - openapi/x-community-notes-api-openapi.yml
  - openapi/x-direct-messages-api-openapi.yml
  - openapi/x-lists-api-openapi.yml
  - openapi/x-media-api-openapi.yml
  - openapi/x-news-api-openapi.yml
  - openapi/x-posts-api-openapi.yml
  - openapi/x-trends-api-openapi.yml
  - openapi/x-users-api-openapi.yml
  - openapi/x-webhooks-api-openapi.yml
docs: https://docs.x.com/fundamentals/authentication/overview
description: 'Authentication profile for the X API v2. Three schemes are declared in X''s published contract
  and all three are documented as first-class methods: app-only Bearer for read-only public data, OAuth
  2.0 Authorization Code with PKCE for user context (required for every write), and legacy OAuth 1.0a
  user context. Enterprise endpoints additionally accept Basic Auth.'
discovery:
  authorization_server: https://api.x.com/.well-known/oauth-authorization-server
  authorization_server_status: 200
  protected_resource: https://api.x.com/.well-known/oauth-protected-resource
  protected_resource_status: 200
  openid_connect: false
  dynamic_client_registration: false
  note: X serves RFC 8414 and RFC 9728 metadata but no OpenID Connect discovery document, and it documents
    explicitly that api.x.com/mcp does not advertise native MCP OAuth discovery and has no dynamic client
    registration — you must bring your own registered developer app.
methods:
- name: App-only Bearer token
  scheme: BearerToken
  type: http
  bearer: true
  use: Read-only access to public data; no user context. Obtained from the app Keys and tokens page in
    the Developer Console.
  docs: https://docs.x.com/fundamentals/authentication/oauth-2-0/application-only
- name: OAuth 2.0 Authorization Code with PKCE
  scheme: OAuth2UserToken
  type: oauth2
  use: User context with granular scopes. Required for all writes and for the xurl MCP bridge.
  scopes: 29
  detail: ../scopes/x-scopes.yml
  docs: https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code
- name: OAuth 1.0a user context
  scheme: UserToken
  type: http
  http_scheme: OAuth
  use: Legacy signed-request user context, still supported for v2 and required by some v1.1 endpoints.
  docs: https://docs.x.com/fundamentals/authentication/oauth-1-0a/api-key-and-secret
- name: Basic Auth
  scheme: null
  type: http
  use: Some Enterprise (GNIP lineage) endpoints only; not part of the v2 securitySchemes.
  source: https://docs.x.com/AGENTS.md
credentials:
  issued_by: https://console.x.com
  test_credentials: false
  note: One credential set per app; nothing distinguishes test from production. See ../sandbox/x-sandbox.yml.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/x-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.