X (Twitter)

X (Twitter)

This connector works with an X account through the X API v2 (https://api.x.com/2), as the user who authorizes it: accounts, posts (read, search, count, publish, reply, quote, delete), the home timeline, mentions, likes, reposts, bookmarks, followers and following, Lists and direct messages.

Pricing: X API access is paid. The X API is billed per use with prepaid credits; new developers get no free plan (the old Free, Basic and Pro subscriptions are closed to them). Reading a post, an account or a message costs credits, publishing a post costs more, and a post with a link much more; reads of your own data are cheaper when the account that authorizes the connector also owns the developer app, and the same object read twice in one UTC day is billed once. When the balance runs out, X refuses every call until credits are added. Buy credits and set a spending limit in the Developer Console (https://console.x.com); check current prices at https://docs.x.com/x-api/getting-started/pricing. Keep max_results small and use expansions only when needed: each object returned is billed.

Setup (one-time, about 10 minutes)

1. Open the X Developer Console at https://console.x.com, sign in with the X account that owns the app, and Create App (name, description, use case). Add credits under billing, or calls are refused.
2. Open the app's User authentication settings and click Set up: App permissions Read and write and Direct message (Read and write is enough without the DM tools); Type of App Web App, Automated App or Bot (a confidential client, which gets a client secret); Callback URI https://cloud.anythingmcp.com/api/mcp-oauth/callback on AnythingMCP Cloud, or <your AnythingMCP URL>/api/mcp-oauth/callback when you host AnythingMCP yourself (X compares it exactly, trailing slash included; for a local test use http://127.0.0.1:<port>/..., not localhost); a Website URL. Save.
3. Copy the OAuth 2.0 Client ID and Client Secret (shown once) into X_CLIENT_ID and X_CLIENT_SECRET. The API Key and Secret and the Bearer Token of the app are for other sign-in methods and are not used here.
4. Install the connector, click Authorize with Provider and allow access on X. The connector asks for tweet.read, tweet.write, users.read, follows.read, follows.write, like.read, like.write, bookmark.read, bookmark.write, list.read, dm.read, dm.write and offline.access. Access tokens last two hours and are renewed automatically with the refresh token (offline.access); each refresh token works once.

Read-only or no DMs: remove the .write scopes (or the dm. scopes) in the connector's OAuth settings, authorize again and switch off the tools that need them.

Your user id first: tools that act on your own account (home timeline, likes, reposts, bookmarks, follows) take user_id, which is the numeric id from x_get_me, not the @username. x_get_user_by_username turns any @username into its id.

Confirm first: x_create_post, x_reply_to_post, x_quote_post, x_repost, x_send_dm and x_send_dm_to_conversation publish or deliver at once and cannot be taken back quietly. Show the user the exact text and the target, and wait for a yes. x_follow_user and x_unfollow_user notify or affect other people; confirm them too. x_delete_post and x_delete_dm are installed switched off.

Replies: X refuses API replies to posts whose author did not mention or quote the replying account (403), to keep automated replies out. Replying in your own threads and to mentions works.

Fields and expansions: X returns only id and text unless fields are asked for; every post tool asks for a useful default set (tweet_fields). Expansions (author_id, referenced_tweets.id, ...) put the related accounts and posts in includes, billed as extra reads. Long posts carry their full text in note_tweet (asked for by default); text holds only the first 280 characters. Lists use meta.next_token: pass it as pagination_token (next_token for searches) for the next page.

Partial answers: lookups by several ids or usernames answer 200 with data for what was found and errors (e.g. resource-not-found, not-authorized-for-resource) for the rest.

Search covers the last 7 days (x_search_recent_posts, x_count_recent_posts); queries are limited to 512 characters, and keyword searches no longer return reposts. Operators: from:, to:, @mention, #hashtag, "exact phrase", -term, lang:en, is:retweet, is:reply, has:links, has:media, url:, conversation_id:.

Direct messages cover the last 30 days of regular DMs; encrypted conversations are not available through the API.

Common errors

• 401: the token was revoked or the app's secret changed; authorize again.
• 403 with client-forbidden or client-not-enrolled, or 429 UsageCapExceeded naming an old product such as standard-basic: the app is not on pay-per-use. In the Developer Console open the app, Move to package → Pay-per-use and put it in the Production environment (or create a new app), and make sure there are credits. 403 on a write: a missing scope or app permission (authorize again after changing it), a reply X does not allow, a duplicate post, or a DM the recipient does not accept.
• Every call failing after it worked before: the credit balance or the spending limit is used up; add credits or raise the limit.
• 429: rate limit per 15 minutes (per user and per app) or the monthly read cap; x-rate-limit-reset says when it resets. Wait and try again.

Out of scope here: media upload (posts are text or polls), the full-archive search, streams, Spaces, Communities, List and account management (create Lists, mute, block) and ads.