Getting Enterprise Access

Apply for Enterprise API access and get onboarded

Enterprise access requires an application and onboarding process. Your dedicated account team will help you get set up with credentials and configure your access.

---

Step 1: Apply for Enterprise access

1. Submit an application

   Fill out the Enterprise interest form with details about your organization and use case.

2. Discuss your needs

   Our sales team will reach out to understand your data volume, endpoint requirements, and support needs.

3. Get a custom package

   Receive a tailored plan with pricing, rate limits, and access levels designed for your use case.

---

Step 2: Get onboarded

Once your Enterprise plan is in place, your dedicated account manager will help you set up:

1. Create your developer app

   Set up your app in the Developer Console with Enterprise-level access.

2. Configure your access

   Your account manager will help configure rate limits, endpoint access, and any custom settings.

3. Generate credentials

   Generate your API keys and tokens for authentication.

---

Step 3: Save your credentials

You’ll receive several credentials depending on your authentication needs:

Credential	Purpose
API Key & Secret	Identify your app. Used to generate tokens and sign OAuth 1.0a requests.
Bearer Token	App-only authentication for reading public data.
Access Token & Secret	Make requests on behalf of your own account (OAuth 1.0a).
Client ID & Secret	OAuth 2.0 authentication for user-context requests.

Save immediately. Credentials are only displayed once. Store them in a password manager or secure vault. If you lose them, you’ll need to regenerate (which invalidates the old ones).

---

Which credentials do you need?

Reading public data

Use the Bearer Token for simple, read-only access to public data.

curl "https://api.x.com/2/users/by/username/xdevelopers" \
  -H "Authorization: Bearer $BEARER_TOKEN"

Best for: Searching posts, looking up users, reading trends.

Acting as a user

Use OAuth 2.0 (recommended) or OAuth 1.0a to act on behalf of users.

OAuth 2.0 offers fine-grained scopes—request only the permissions you need.

Best for: Posting, liking, following, accessing DMs.

OAuth 2.0 guide →

Acting as yourself

Use your Access Token & Secret to make requests as your own account.

These tokens represent the account that owns the app.

Best for: Testing, personal bots, your own automation.

---

Credential security best practices

Use environment variables

Never hardcode credentials in your source code.

Don't commit to git

Add credential files to .gitignore.

Rotate regularly

Regenerate credentials periodically as a security measure.

Use minimal scopes

Only request the OAuth permissions your app needs.

---

Next steps

Make your first request

Call the API with your new credentials.

Learn about authentication

Understand OAuth 1.0a and OAuth 2.0.