Change your password: POST /client/password

Docs

Change your password

Change the password of your account. Returns the new auth_token, because X logs out every session when the password changes.

POST/client/password

Your account, your proxy, your risk.

Account actions run with the session cookie of your own X account and go out through your own proxy. Use only accounts you control and follow X's rules. Automated posting, following or liking can get the account limited or suspended; that is between you and X. Treat the cookie like a password: it gives full access to the account. Trial keys cannot call these endpoints.

How to copy the cookie and which proxy to use: Your X session (cookie).

Runs the same request as Settings → Change your password on x.com.

On success X ends every session of the account, including the cookie you sent, and sets a new auth_token. The answer carries it as auth_token, next to ct0, which stays the same. Replace auth_token in your stored cookie with the new value before the next call; the old cookie no longer works.

Parameters

cookiebody · string · required
Cookie header of your own logged-in X session: auth_token=...; ct0=... (guest_id is used when present). How to copy it: /docs/x-session.
proxybody · string · required
Your proxy, format http://user:pass@host:port. The requests to X go out through it. Used only for this request.
current_passwordbody · string · required
The password the account has now.
passwordbody · string · required
The new password, at least 8 characters.
password_confirmationbody · string · optional
The new password again. Left out, password is used; when set, it must match password.

Name	In	Type	Required	Description
cookie	body	string	yes	Cookie header of your own logged-in X session: auth_token=...; ct0=... (guest_id is used when present). How to copy it: /docs/x-session.
proxy	body	string	yes	Your proxy, format http://user:pass@host:port. The requests to X go out through it. Used only for this request.
current_password	body	string	yes	The password the account has now.
password	body	string	yes	The new password, at least 8 characters.
password_confirmation	body	string	no	The new password again. Left out, password is used; when set, it must match password.

Body parameters are sent as a JSON object with Content-Type: application/json.

Notes

X refuses a wrong current_password; the answer then has X's status and body, and the password stays unchanged.
The new password is not stored or logged by the API.
No simple format: with format=simple the answer is the usual {status_code, response} wrapper.
The cookie and proxy fields: Your X session (cookie).

Example request

curl -X POST 'https://api.twittrapi.com/client/password' \
  --header 'X-API-KEY: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"cookie":"auth_token=...; ct0=...","proxy":"http://user:pass@host:port","current_password":"old-password","password":"new-password-123"}'

import httpx

resp = httpx.post(
    "https://api.twittrapi.com/client/password",
    headers={"X-API-KEY": "YOUR_API_KEY"},
    json={
        "cookie": "auth_token=...; ct0=...",
        "proxy": "http://user:pass@host:port",
        "current_password": "old-password",
        "password": "new-password-123",
    },
    timeout=60,
)
print(resp.status_code, resp.json())

const resp = await fetch("https://api.twittrapi.com/client/password", {
  method: "POST",
  headers: { "X-API-KEY": process.env.TWITTRAPI_API_KEY, "Content-Type": "application/json" },
  body: JSON.stringify({
    cookie: "auth_token=...; ct0=...",
    proxy: "http://user:pass@host:port",
    current_password: "old-password",
    password: "new-password-123",
  }),
});
console.log(resp.status, await resp.json());

Base URL https://api.twittrapi.com, key in the X-API-KEY header. The SDKs do not wrap account actions, so the examples are plain HTTP calls.

Response

Wrapper built by the API: {"status_code": <X status>, "response": "<X response body as a string>", "auth_token": "<new auth_token>", "ct0": "<ct0>"}. On success X's body is {"status":"ok"}. auth_token and ct0 are only present after a successful change. The HTTP status is X's status when X answered 4xx or 5xx, otherwise 200.

Example response coming soon.

In the raw format, field names and nesting come from X and can change without notice. See Response format.

Errors

400The body is not valid JSON.
422A required field is missing (including proxy), an ID is not numeric, or the cookie has no ct0. Also: the account is suspended, X rejected the session, or the text was already posted.
407The proxy is unreachable or timed out.
422current_password or password is missing, password is shorter than 8 characters, or password and password_confirmation do not match. Checked before anything is sent to X.
503X did not accept the request right now. Try again later; the password is unchanged.
X'sAny status X answers with (for example 401, 403, 404): passed through with X's body.

Errors every endpoint can return (401, 402, 403, 404, 408, 409, 429, 5xx), and which of them are charged, are on the Errors page. Calls that fail with 400, 407, 408, 409 or a 5xx error are refunded.