Authentication Fresh

X APIs handle enormous amounts of data. Authentication is how that data is secured for developers and users alike. There are a few methods, each suited to a different access need.

Most developers will not need to deal with the complexities of signing requests directly - client libraries (and XMCP) handle that for you.

Authentication methods

Method	What it grants	Typical use
OAuth 1.0a User Context	Access private account info or act on behalf of an account	XMCP's default consent flow; create posts, like, follow
App-only (Bearer Token)	Access publicly available information	Read-only lookups and search
OAuth 2.0 Authorization Code with PKCE	User context with scoped authorization across devices	Fine-grained, modern user-context auth
Basic authentication	Required by some enterprise endpoints	Enterprise APIs

How XMCP uses these

flowchart TD
    XMCP[XMCP] --> Bearer[X_BEARER_TOKEN
app-only reads]
    XMCP --> OAuth1[OAuth 1.0a consent
user-context actions]
    OAuth1 --> Consent[Browser consent at startup]
    Consent --> Mem[Tokens held in memory]
    XMCP -. optional .-> OAuth2[OAuth 2.0 token
X_OAUTH_ACCESS_TOKEN]

XMCP requires both a Bearer token and OAuth 1.0a consumer credentials. At startup it opens a browser for OAuth 1.0a consent so it can perform user-context actions. Optionally, you can supply an OAuth 2.0 user token instead - see Generate an OAuth 2.0 Token.

Where credentials come from

Your app's API keys and app-only Bearer token, plus your personal access token and secret, come from the Developer Apps section of the Developer Console (https://console.x.com).

Acting on behalf of another user

To make requests on behalf of a different user, generate a separate set of access tokens for that user with the 3-legged OAuth flow, then pass those tokens with your OAuth 1.0a or OAuth 2.0 user-context requests.

App-only vs user context

flowchart LR
    Q{What are you doing?} -->|Reading public data| AppOnly[App-only Bearer token]
    Q -->|Acting as an account| User[OAuth 1.0a or OAuth 2.0 user context]
    AppOnly --> RL1[Per-app rate limits]
    User --> RL2[Per-user rate limits]

The auth context you use also determines which rate limits apply.

Best practices

Protect your keys and tokens; never commit them or paste them into shared spaces.
Use the narrowest auth context that accomplishes the task (app-only for reads).
Regenerate credentials immediately if exposed.
Combine with Tool Allow-Listing to bound what an agent can do even with valid credentials.

Authentication Fresh ​

Authentication methods ​

How XMCP uses these ​

Where credentials come from ​

App-only vs user context ​

Best practices ​