# X: OAuth app setup and approval
Gated · Sourced · updated 27 Oct 2026 · https://oauth-guide.akshatsethi.com/apps/x

> Any X user can connect as soon as you register an app in the X Developer Console, and the docs describe no app review. You must still buy prepaid pay-per-use credits, because new developers get no free tier and calls fail without a balance.

- **Your hands-on work:** 30–90 min
- **Waiting on X:** None
- **First user can connect:** Today, in about an hour, once you've bought credits
- **Why Gated:** The docs describe no app review, but you can't use the API at all until you buy credits, and volume past 3M post reads per billing cycle needs an Enterprise plan.
- **Using Composio?** Composio lists Twitter (TWITTER) and X MCP under bring-your-own OAuth apps. Register your own X app, load credits on it, and enter its Client ID and Secret in Composio.

## Path to launch
### Build: Your app
- Who can connect: Any X account, including yours. The docs describe no development mode or test-user list.
- What users see: X's standard authorization screen, showing your app name and the requested scopes.
- Effort: 30–90 min · Wait: None
- Next: Buy credits, and keep the balance positive.
- _(Docs [2, 3, 4], medium confidence)_

### Launch: Public use
- Who can connect: Any X user, as long as your credit balance and spending limit allow calls.
- What users see: The same authorization screen. The docs mention no unverified-app warning.
- Effort: 0–30 min · Wait: None
- _(Docs [3], medium confidence)_

## Before you start
- [ ] **An X account** (You). You sign in to console.x.com with an X account and accept the Developer Agreement and Policy. _(Docs [2])_
- [ ] **Payment card and prepaid credits** (You). Each API request draws down prepaid credits, and requests are blocked when the balance is negative. Examples: post reads cost $0.005 and post creates cost $0.015. _(Docs [3])_
- [ ] **An HTTPS redirect URI** (Agent). Use an https:// callback in production. For local testing, use http://127.0.0.1, not localhost. _(Docs [4])_
- [ ] **Enterprise plan for high volume** (You). Pay-per-use is capped at 3 million post reads per monthly billing cycle. Above that, you need an Enterprise plan. _(Docs [3])_

## Steps
1. **Sign in to the X Developer Console** (You, 5–15 min). Sign in to console.x.com with your X account, accept the Developer Agreement and Policy, and fill in the profile describing how you'll use the API. _(Docs [2])_
   - Go to console.x.com and sign in
   - Accept the Developer Agreement and Policy
   - Complete the use-case profile
   - Agent: A person must sign in and accept the terms. After that, an agent can help draft the use-case text.
2. **Add a card and buy API credits** (You, 5–15 min). Buy credits in the console's billing section, and set a spending limit for each billing cycle. You can also turn on auto-recharge so calls don't stop when the balance runs out. _(Docs [3, 7])_
   - Save a payment card
   - Buy an initial credit amount
   - Set a spending limit
   - Optionally turn on auto-recharge
   - Agent: Payment needs a person.
   - Watch out: With a zero balance, every call returns 402 CreditsDepleted, including calls made right after a user connects.
3. **Create a new app** (Agent, 5–10 min). On the dashboard, click New App and enter a name, description and use case. The name is what users see on the consent screen. _(Docs [2, 4])_
   - Click New App
   - Enter the name, description and use case
   - Agent: An agent can fill in the form. A person should save any keys that appear, because they're shown only once.
   - Watch out: Credentials are shown only once. If you don't save them, you'll have to regenerate them.
4. **Set up OAuth 2.0 user authentication** (Agent, 10–20 min). In the app's authentication settings, turn on OAuth 2.0 and choose an app type. Web App and Automated App/Bot are confidential clients and get a Client Secret. Native App and Single Page App use PKCE only. Set the permissions to match the scopes you'll request. _(Docs [1, 4, 6])_
   - Turn on OAuth 2.0
   - Choose Web App as the type if you have a backend
   - Set permissions: Read, Read and write, or Read, write and DMs
   - Add your redirect URI exactly, up to 10 URIs
   - Agent: An agent can complete this form. Leave the Client Secret for a person to copy.
   - Watch out: Callback URLs must match exactly, including trailing slashes. Requesting write scopes while the app has Read-only permission makes authorization fail.
5. **Store the Client ID and Client Secret** (You, 5–10 min). Copy the OAuth 2.0 Client ID and Secret from Keys and Tokens into your OAuth client's secret storage. _(Docs [1])_
   - Open Keys and Tokens
   - Copy the Client ID and Client Secret into your secret store
   - Agent: A person handles the secret. An agent can enter the Client ID.
6. **Point your OAuth client at X's endpoints** (Agent, 10–20 min). Use the authorize URL https://x.com/i/oauth2/authorize and the token URL https://api.x.com/2/oauth2/token, with PKCE (S256) and a state value. Request offline.access to get a refresh token, because access tokens expire after 2 hours. _(Docs [1, 6])_
   - Set the authorize and token URLs
   - Turn on PKCE
   - Add scopes such as tweet.read, users.read and offline.access, plus tweet.write if you post
   - Agent: An agent can configure this and test a connection.
   - Watch out: The authorization code expires 30 seconds after approval, so exchange it immediately. OAuth 2.0 tokens work only with API v2. Invalid scopes such as users.email break the flow.
7. **Test a connection, then open it to users** (Agent, 10–30 min). Connect an X account and make a v2 call such as /2/users/me. The docs describe no review step, so once this works, any X user can connect. _(Inferred [1, 3], medium confidence)_
   - Run the authorization flow
   - Call /2/users/me
   - Monitor credit usage in the console
   - Agent: An agent can run the test after a person logs in to X.

## When you get stuck
- **402 CreditsDepleted on every API call.** The app's credit balance is zero or negative. Fix: Buy credits or turn on auto-recharge in the Developer Console. _(Community [7, 3])_
- **"Something went wrong" page on X after authorizing.** Usually the redirect URI doesn't match exactly, an invalid scope was requested, or the scopes exceed the app's permission level. Fix: Check that the callback matches exactly, request only documented scopes, and raise the app's permissions if you need write access. _(Community [5, 6], medium confidence)_
- **Token exchange fails with invalid_request.** The authorization code expires 30 seconds after approval, or the PKCE verifier doesn't match. Fix: Exchange the code immediately, using the same code_verifier. _(Docs [1], medium confidence)_

## Not confirmed yet
- **Does X ever review or restrict OAuth apps before public use?** The docs mention suspension and appeals but no proactive review. The use-case profile's review process isn't documented. To resolve: Check the Developer Console after you create the app, or ask on devcommunity.x.com.
- **Is there a limit on the number of users who can authorize an app?** None of the fetched docs mention per-app user caps. To resolve: Check the X API rate-limit docs and the console.
- **Is any free access still available?** Third-party reports mention case-by-case free access for public-utility apps, and the official pricing page doesn't mention a free tier. To resolve: Contact X developer support.

## Sources
1. [OAuth 2.0 Authorization Code Flow with PKCE](https://docs.x.com/resources/fundamentals/authentication/oauth-2-0/authorization-code) (X Developer docs). Checked 27 Oct 2026
2. [Getting access](https://docs.x.com/x-api/getting-started/getting-access) (X Developer docs). Checked 27 Oct 2026
3. [Pricing](https://docs.x.com/x-api/getting-started/pricing) (X Developer docs). Checked 27 Oct 2026
4. [Developer apps](https://docs.x.com/fundamentals/developer-apps) (X Developer docs). Checked 27 Oct 2026
5. [Supabase X OAuth "Something went wrong" thread](https://www.answeroverflow.com/m/1459601433900093515) (Answer Overflow). Not yet checked
6. [Twitter/X auth](https://docs.replit.com/features/auth-and-identity/twitter-x) (Replit docs). Not yet checked
7. [X API Error Codes Decoder](https://opentweet.io/tools/x-api-error-decoder) (OpenTweet). Not yet checked
8. [Managed auth toolkits](https://docs.composio.dev/toolkits/managed-auth.md) (Composio docs). Checked 27 Oct 2026
9. [X API pay-per-use](https://www.gigazine.net/gsc_news/en/20260209-x-api-pay-per-use/) (Gigazine). Not yet checked

Wrong or out of date? POST https://oauth-guide.akshatsethi.com/api/reports with {"app": "x", "step": 2, "message": "what you saw"} (step is optional), or call the report_problem MCP tool. The next research run checks it.
Followed it? Say how it went: POST https://oauth-guide.akshatsethi.com/api/reports with {"app": "x", "outcome": "worked" | "waiting" | "stuck", "step": 3, "message": "what happened"}, or call the report_setup MCP tool.