---
title: "Twitter API 429, 403 and 401 Errors: Causes and Fixes"
description: "Fix X (Twitter) API errors 429 Too Many Requests, 403 Forbidden and 401 Unauthorized: what each code means on the official X API and TwexAPI, which headers to read, and when to retry."
lastModified: "2026-10-19"
sidebar:
  label: "429, 403 and 401 Errors"
seo:
  title: "Fix Twitter API Errors 429, 403 and 401"
search:
  tags: ["twitter 429 error", "error 429 twitter", "twitter api 403 forbidden", "twitter api 401 unauthorized", "Request failed with status code 401", "x-rate-limit-reset"]
---

**Short answer:** `429` means you sent too many requests and must wait. `403` means your credentials work but are not allowed to do this. `401` means your credentials are missing or wrong. Only a `429` gets better by waiting; a `403` or `401` returns the same error until you change the request, credentials, or access.

| Code | What it means | Check first | Retry? |
| :--- | :--- | :--- | :--- |
| **429 Too Many Requests** | A rate limit, usage cap, or daily account limit was hit | `x-rate-limit-reset` or `Retry-After` header | ✅ After the indicated wait |
| **403 Forbidden** | Authenticated, but not permitted for this endpoint, action, or account | App access, token type, permissions, credits, target account | ❌ Fix access first |
| **401 Unauthorized** | Credentials missing, invalid, expired, or signed incorrectly | `Authorization` header and which key or token you used | ❌ Fix credentials first |

These fixes apply whether you call the API directly or see the error in a tool. Messages like `Request failed with status code 401` or `status code 429` come from the HTTP client (for example axios, used by n8n and many Node.js bots). They carry the status code from the API you called, so the meaning is the same.

## First, check which API returned the error

The same code has different causes depending on who returned it:

- **Official X API** (`api.x.com` or `api.twitter.com`): errors use the X developer platform's rules for apps, projects, OAuth, and rate-limit windows.
- **TwexAPI** (`api.twexapi.io`): errors relate to your TwexAPI key, Credits, and, for write actions, the X session you supplied. See the full [TwexAPI error code reference](/guides/error-reference).
- **The x.com website or app**: a "Rate limit exceeded" message while browsing comes from X's limits on your account, not from any developer API.

## Twitter API 429 Too Many Requests

### On the official X API

X enforces per-endpoint limits in windows that are usually 15 minutes or 24 hours, separately per app and per user. Every response includes three headers:

| Header | Meaning |
| :--- | :--- |
| `x-rate-limit-limit` | Requests allowed in the current window |
| `x-rate-limit-remaining` | Requests left in the current window |
| `x-rate-limit-reset` | Unix timestamp when the window resets |

When you exceed a limit, X returns HTTP `429`. Older v1.1-style bodies show error code `88` and `Rate limit exceeded`. Newer problem responses use the `rate-limit-exceeded` type, or `usage-capped` when your account hit a usage cap rather than a rate window.

To fix it:

1. **Wait until `x-rate-limit-reset`.** Retrying sooner returns another `429`.
2. **Watch `x-rate-limit-remaining`.** Slow down before it reaches zero instead of after.
3. **Check daily limits.** Some write endpoints, such as posting or liking, have 24-hour caps per app or per user. Waiting a few minutes does not reset them.
4. **Cache and spread requests.** Avoid fetching the same profile or tweet repeatedly, and don't start every job at the top of the hour.

Rate limits and billing are separate on the pay-per-use X API. A request can be under the rate limit and still add to your bill, so caching saves money as well as quota.

### On TwexAPI

A TwexAPI `429` can mean request throttling or an X account limit reached during a write action (for example X code `344` posting limits or code `502` daily DM limits). Honor the `Retry-After` header or `retry_after` field when present. Account daily limits need their reset period, not a short retry. See [Rate Limits](/guides/rate-limits) for backoff and pagination-safe recovery.

### On x.com in a browser or the X app

X limits how much each account can load. If you see "Rate limit exceeded" while scrolling, wait before reloading, close extra tabs and auto-refreshing extensions, and avoid shared networks or VPN exits used by many people. To read a public profile without an account, you can use the free [Twitter viewer](https://twexapi.io/twitter-viewer).

## Twitter API 403 Forbidden

A `403` means X or TwexAPI recognized your credentials but refuses the request. Repeating the same request returns the same `403`.

### On the official X API

| Cause | How it shows up | Fix |
| :--- | :--- | :--- |
| **App not enrolled or lacks access** | `client-forbidden` problem type; older responses use code `453` ("You currently have access to a subset of…") | Use keys from an app attached to a Project, and make sure your account's access includes the endpoint |
| **Wrong token type for the endpoint** | Posting, liking, following, or DMs with an app-only Bearer Token | Use a user-context token: OAuth 1.0a access token and secret, or an OAuth 2.0 user token |
| **Missing permissions or scopes** | A user token on a Read-only app, or an OAuth 2.0 token without scopes such as `tweet.write` | Set the app to Read and write (plus Direct Messages if needed), then **regenerate** the access token and secret or re-authorize the user |
| **Protected or unavailable resource** | `not-authorized-for-resource` problem type | The target account is protected, or the content is restricted; request something your user can see |
| **Duplicate or restricted action** | Duplicate post text, reply-restricted posts, already-liked tweets | Change the content or confirm the current state before retrying |

Changing app permissions does not update tokens that already exist. After switching to Read and write, generate new user tokens; otherwise posting keeps returning `403`.

### On TwexAPI

A TwexAPI `403` usually means one of these:

- **Credits exhausted**: check your balance with [Get Balance](/api-reference/balance-endpoints/get-balance-api-balance-get) and top up in the [dashboard](https://twexapi.io/dashboard).
- **Protected or suspended target**: the account's posts aren't readable by anyone outside its approved followers. Point the request at a public account.
- **Account or action restriction**: the X account you supplied for a write action is suspended or locked, the tweet restricts replies (X code `433`), or the action needs X Premium.

Each message is listed with its fix in the [error code reference](/guides/error-reference#common-errors-all-endpoints).

## Twitter API 401 Unauthorized

A `401` means the request didn't prove who you are. Fix the credentials; retrying unchanged never works.

### On the official X API

- **Malformed header**: app-only requests need exactly `Authorization: Bearer <token>`. A missing `Bearer ` prefix, extra quotes, or a trailing newline from an environment variable all return `401`.
- **Regenerated or revoked credentials**: regenerating keys in the developer portal invalidates the old ones immediately. Update every place that stores them.
- **Wrong credential set**: OAuth 1.0a needs the consumer key and secret **plus** the user's access token and secret. Mixing keys from two apps, or using an API key where a token is expected, returns `401`.
- **OAuth 1.0a signature errors**: code `32` (`Could not authenticate you`) usually means a bad signature. Check URL encoding of parameters and that your server clock is accurate; a skewed timestamp invalidates the signature.
- **Expired OAuth 2.0 user token**: user access tokens expire. Request the `offline.access` scope and use the refresh token to get a new one.

### On TwexAPI

- **API key missing or wrong**: send `Authorization: Bearer YOUR_API_KEY` with a key from the [dashboard](https://twexapi.io/dashboard). See [Authentication](/authentication).
- **Expired X session on write endpoints**: `Invalid auth_token` or X code `32` on posting, liking, or DMs means the X session credentials you supplied in `cookie` expired. Refresh them; your API key is fine.

## Retry only what can succeed

This Python helper retries `429` and transient `5xx` responses and returns every other status immediately. It honors `Retry-After` (TwexAPI and most HTTP APIs) and `x-rate-limit-reset` (official X API):

```python
import random
import time

import requests


def request_with_retry(method, url, max_attempts=5, **kwargs):
    for attempt in range(max_attempts):
        response = requests.request(method, url, timeout=30, **kwargs)
        if response.status_code != 429 and response.status_code < 500:
            return response  # success, or a 4xx that waiting won't fix

        wait = None
        retry_after = response.headers.get("Retry-After", "")
        reset_at = response.headers.get("x-rate-limit-reset", "")
        if retry_after.isdigit():
            wait = int(retry_after)
        elif reset_at.isdigit():
            wait = max(0, int(reset_at) - time.time()) + 1
        if wait is None:
            wait = min(300, 5 * 2 ** attempt) + random.uniform(0, 1)

        time.sleep(wait)

    return response
```

For reads that page through results, retry the **same cursor** after a `429`, not the next one. For write actions, check whether the post, like, or DM already went through before sending it again; a timeout does not prove the action failed.

## When the official limits are the real problem

If your app keeps hitting `429` on reads, or the per-request bill grows faster than the data you need, compare the cost of a metered third-party API. TwexAPI reads cost about $0.05 per 1,000 tweets with an API key and no OAuth setup, against $5 per 1,000 posts read on the official X API. See [TwexAPI vs the official X API](/comparison/official-x-api) and the [X API pricing calculator](https://twexapi.io/x-api-pricing). TwexAPI is not affiliated with or endorsed by X Corp.

## Twitter API 429, 403 and 401 questions

### How long does a Twitter API 429 last?

Until the time in `x-rate-limit-reset`, which is usually within 15 minutes. Endpoints with 24-hour limits, such as posting, stay blocked until the daily window resets. On TwexAPI, wait for `Retry-After` or `retry_after`.

### Why do I get 403 Forbidden when posting a tweet with the X API?

Usually because the token can't write. You may be using an app-only Bearer Token, the app is set to Read only, or the user token was created before you enabled Read and write. Enable write permission, regenerate the user's tokens, and post with user-context authentication.

### What does "Request failed with status code 401" mean in n8n?

The X API or TwexAPI rejected the credentials in that HTTP node. Check that the `Authorization` header is `Bearer` followed by a valid key or token, that the credential wasn't regenerated, and that a write action uses user-context credentials. See the [n8n guide](/guides/n8n) for a working TwexAPI setup.

### What is the difference between a 403 and a 429?

`429` means you sent too many requests and must wait. `403` means you aren't allowed to make the request at all. Waiting fixes a `429`; a `403` needs a change in access, permissions, credits, or the target.

### What is Twitter error code 88?

X error code `88` means `Rate limit exceeded`, and it is returned with HTTP `429`. Wait until `x-rate-limit-reset` before the next request.

### What is Twitter error code 32?

X error code `32` means `Could not authenticate you`, returned with HTTP `401`. On the official API it usually points to a bad OAuth 1.0a signature or wrong tokens. On TwexAPI write endpoints, it means the X session credentials you supplied have expired.

## Related pages

- [Twitter API error code reference](/guides/error-reference): every TwexAPI status and X error code with its fix
- [Rate Limits](/guides/rate-limits): backoff, `Retry-After`, and pagination-safe recovery
- [Error Handling](/guides/error-handling): MCP, SDK, and write-action recovery
- [Authentication](/authentication): API keys and X session credentials