Authentication
All X API v2 endpoints require authentication. Choose the method that fits your use case:| Method | Best for | Can access private metrics? |
|---|---|---|
| OAuth 2.0 App-Only | Server-to-server, public data | No |
| OAuth 2.0 Authorization Code with PKCE | User-facing apps | Yes (for authorized user’s Posts) |
| OAuth 1.0a User Context | Legacy integrations | Yes (for authorized user’s Posts) |
App-Only authentication
For public Post data, use a Bearer Token:cURL
User Context authentication
To access private metrics, authenticate on behalf of the Post author:Fields and expansions
The X API v2 returns minimal data by default. Usefields and expansions to request exactly what you need.
Default response
Available fields
tweet.fields
tweet.fields
| Field | Description |
|---|---|
created_at | Post creation timestamp |
author_id | Author’s user ID |
public_metrics | Like, retweet, reply, quote counts |
entities | Hashtags, mentions, URLs, cashtags |
attachments | Media keys, poll IDs |
conversation_id | Thread identifier |
context_annotations | Topic/entity classifications |
in_reply_to_user_id | User being replied to |
lang | Detected language |
source | Posting client |
possibly_sensitive | Sensitive content flag |
reply_settings | Who can reply |
user.fields (requires author_id expansion)
user.fields (requires author_id expansion)
media.fields (requires attachments.media_keys expansion)
media.fields (requires attachments.media_keys expansion)
| Field | Description |
|---|---|
url | Media URL |
preview_image_url | Thumbnail URL |
type | photo, video, animated_gif |
duration_ms | Video duration |
height, width | Dimensions |
alt_text | Accessibility text |
Example with fields
cURL
Post edits
Posts can be edited up to 5 times within 30 minutes of creation.How it works
- Each edit creates a new Post ID
edit_history_tweet_idscontains all versions (oldest first)- The endpoint always returns the most recent version
Example response
Error handling
Common errors
| Status | Error | Solution |
|---|---|---|
| 400 | Invalid request | Check parameter formatting |
| 401 | Unauthorized | Verify authentication credentials |
| 403 | Forbidden | Check App permissions |
| 404 | Not Found | Post deleted or doesn’t exist |
| 429 | Too Many Requests | Wait and retry (see rate limits) |
Deleted or protected Posts
If a Post is deleted or from a protected account you don’t follow:- Single Post lookup returns
404 - Multi-Post lookup omits the Post from results with an
errorsarray
Best practices
Batch requests
Use the multi-Post endpoint to fetch up to 100 Posts at once, reducing API calls.
Request only needed fields
Specify only the fields you need to minimize response size and processing time.
Cache responses
Cache Post data locally to reduce repeated requests for the same content.
Handle edits
For real-time apps, consider re-fetching Posts after the 30-minute edit window.