Authentication

Bearer token authentication for Twexapi — use with Cursor, Claude Code, GitHub Copilot, ChatGPT, and AI coding agents. Get started in minutes.

API Authentication

Twexapi uses Bearer token authentication to secure all API requests. Each request must include a valid API key in the Authorization header to access our endpoints.

Getting Your API Key

Follow these simple steps to obtain your API key:

Sign in to your Twexapi Dashboard
Your unique API key will be displayed prominently on the dashboard homepage
Copy the key securely - you’ll need it for all API requests

Using Your API Key

Include your API key in the Authorization header of every request using the Bearer token format:

Required Header:

Authorization: Bearer YOUR_API_KEY

Environment variable

SDKs and the CLI read the same credential from the environment:

export X_API_SCRAPER_KEY="YOUR_API_KEY"

Use Authorization: Bearer YOUR_API_KEY in raw HTTP requests. Generated SDKs accept bearer_auth or equivalent options—see each SDK page.

Authenticate with MCP

Connect AI agents to https://api.twexapi.io/mcp with your API key:

{
  "headers": {
    "x-api-key": "YOUR_API_KEY"
  }
}

Some clients accept Authorization: Bearer YOUR_API_KEY instead. See MCP Server for Cursor, Claude Code, Codex CLI, and other client configs.

Authenticate with AI Coding Agents

Install the TwexAPI skill so Cursor, Claude Code, GitHub Copilot, ChatGPT, Cline, Windsurf, Codex, Gemini CLI, Continue, Roo Code, and other AI assistants know how to attach Bearer tokens correctly. Setup guides and CLI options are on the integrations hub.

npx skills add twexapi-dev/x-api-scraper-cli

In Cursor, GitHub Copilot, Claude Code, ChatGPT, Continue, Roo Code, or any supported agent, try prompts like “configure Twexapi auth from my .env file”, “add Bearer authentication to this API client”, or “generate a test request with my API key”.

While all public read endpoints (search, user profiles, tweets, followers, threads, trends) require zero cookies or Twitter login credentials, write actions operate under a Bring Your Own Cookie (BYOC) model.

Supported Write Actions

Creating Tweets & Thread Posts (POST /twitter/tweets/create, POST /v3/twitter/tweets/create_thread)
Liking & Retweeting (POST /twitter/tweets/{tweet_id}/like, POST /twitter/tweets/{tweet_id}/retweet)
Sending Direct Messages (POST /v3/twitter/send_dm)
Following Accounts (POST /twitter/user/follow)

Delegated Execution & Zero-Retention Security

User-Owned Authorization

You pass your own Twitter account’s auth_token or cookie string. TwexAPI acts strictly as a stateless execution gateway on your behalf.

Zero Credential Retention

Session tokens are held strictly in ephemeral server memory during the execution of that specific HTTP request. They are never saved to disk or databases.

Full Legal & Content Protection

Because actions are executed with your explicitly authorized account credentials, your team retains full copyright ownership and eliminates third-party impersonation liabilities.

No Shared Account Contamination

TwexAPI never uses pooled, recycled, or shared burner accounts for write operations. Your actions are completely isolated to your own accounts.

How to Authenticate Write Requests

In addition to your Authorization: Bearer YOUR_API_KEY header, provide your account’s auth_token or cookie string directly in the request payload:

curl -X POST "https://api.twexapi.io/twitter/tweets/create" \
  -H "Authorization: Bearer YOUR_TWEXAPI_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "tweet_text": "Hello world from an automated pipeline!",
    "cookie": "auth_token=YOUR_TWITTER_AUTH_TOKEN; ct0=YOUR_CT0_TOKEN"
  }'

Implementation Examples

Here are practical examples showing how to authenticate your requests across different programming languages:

cURL

Perfect for testing and quick API exploration:

curl --request GET \
  --url 'https://api.twexapi.io/twitter/users?usernames=elonmusk' \
  --header 'Authorization: Bearer YOUR_API_KEY' \
  --header 'Content-Type: application/json'

Python

Using the popular requests library:

import requests

# API endpoint and parameters
url = "https://api.twexapi.io/twitter/users"
params = {"usernames": "elonmusk"}

# Authentication header
headers = {
    "Authorization": "Bearer YOUR_API_KEY",
    "Content-Type": "application/json"
}

# Make the request
response = requests.get(url, headers=headers, params=params)

# Handle the response
if response.status_code == 200:
    data = response.json()
    print(data)
else:
    print(f"Error: {response.status_code} - {response.text}")

JavaScript (Node.js/Browser)

Modern fetch API implementation:

const fetchUserData = async () => {
  const options = {
    method: 'GET',
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY',
      'Content-Type': 'application/json'
    }
  };

  try {
    const response = await fetch(
      'https://api.twexapi.io/twitter/users?usernames=elonmusk', 
      options
    );
    
    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }
    
    const data = await response.json();
    console.log(data);
  } catch (error) {
    console.error('Request failed:', error);
  }
};

fetchUserData();

Java

Using Unirest for simplified HTTP requests:

import kong.unirest.HttpResponse;
import kong.unirest.Unirest;

public class TwitterApiExample {
    public static void main(String[] args) {
        try {
            HttpResponse<String> response = Unirest
                .get("https://api.twexapi.io/twitter/users?usernames=elonmusk")
                .header("Authorization", "Bearer YOUR_API_KEY")
                .header("Content-Type", "application/json")
                .asString();
            
            if (response.getStatus() == 200) {
                System.out.println(response.getBody());
            } else {
                System.err.println("Error: " + response.getStatus() + " - " + response.getBody());
            }
        } catch (Exception e) {
            System.err.println("Request failed: " + e.getMessage());
        }
    }
}

Best Practices & Next Steps

Environment Variables: Store your API key in X_API_SCRAPER_KEY or a secrets manager, never hardcode it
Transparent Billing: Review pay-per-request micro-rates in our Pricing & Billing Guide
Error recovery: Handle 4xx/5xx responses — see Error Handling
Rate limits: Back off on 429 — see Rate Limits
Zero-Cookie Public Reading: Understand why no login cookies are needed compared to self-hosted setups in Self-Hosted Scraper vs TwexAPI and Nitter Alternatives
Architecture Evaluation: Compare TwexAPI against the official X API (Pay-as-you-go per-resource vs per-request) in our Official X API Comparison
HTTPS Only: All requests must use HTTPS for security