How it works
- Log in once with
/twitter/user_login_v2(email, username, password and 2FA secret). It returnslogin_cookies. Enable 2FA on the account first. Without it, the returned cookies may be faulty and posting can fail. - Call any V2 endpoint with your
x-api-keyheader and a JSON body that contains:login_cookies: the value from step 1.proxy: a high-quality residential proxy, for examplehttp://username:password@ip:port. Avoid free proxies.- The target, usually
tweet_idoruser_id.
- Check
statusin the response. It issuccessorerror. Onerror,messagecarries the reason X gave, and when available alsox_status(the HTTP status from X) andcode(X’s error code).
login_cookies from user_login_v2 only work with endpoints that end in _v2.
Endpoints
Billing: a call is charged when it returns HTTP 200, including when X rejects the action and
status is error. Requests rejected with HTTP 400 for missing or invalid parameters are not charged.
Behaviour worth knowing
- Already done counts as success. Liking an already liked tweet, retweeting an already retweeted tweet, or following someone you already follow (or have a pending request to) returns
success. - Undo actions are no-ops when nothing is there. Undoing a retweet you never made returns
success, because X treats it as a no-op. - Pin works only on your own tweets. Pinning someone else’s tweet returns an error.
- Block removes follows both ways, and unblocking doesn’t restore them.
- Not found: acting on a user or tweet that doesn’t exist or was suspended returns an error that says so.
What’s new (October 2026)
- New endpoints: unretweet, pin, unpin, mute, unmute, block and unblock.
- More reliable media upload.
- Unfollow and profile, avatar and banner updates now work for accounts logged in with
user_login_v2. - Like, retweet and follow now return X’s real reason when X rejects the action, instead of reporting success.