Authentication
Send your TwittrAPI key in the X-API-KEY header. What happens when the key is missing, unknown, deactivated or out of balance.
Every request needs your API key in the X-API-KEY header. There is no OAuth flow and no X developer account involved.
curl 'https://api.twittrapi.com/simpletweet/20' \
--header 'X-API-KEY: YOUR_API_KEY'curl 'https://twitter-aio.p.rapidapi.com/simpletweet/20' \
--header 'x-rapidapi-host: twitter-aio.p.rapidapi.com' \
--header 'x-rapidapi-key: YOUR_API_KEY'The key comes from the dashboard after you sign up on the get started page. RapidAPI keys use different headers and a different host; see Using RapidAPI instead and Find your RapidAPI host.
Keep the key secret
The key spends your balance. Keep it on the server side:
- Read it from an environment variable or a secret store. The SDKs read
TWITTRAPI_API_KEY. - Do not put it in browser or mobile app code, where anyone can extract it. Call the API from your backend instead.
- If a key leaks, use "Regenerate key" on the API key page of the dashboard. The old key stops working at once; balance and settings stay.
Auth errors
These errors are not charged:
| Status | Body (error) | Meaning |
|---|---|---|
| 401 | missing api key | No X-API-KEY header. |
| 401 | invalid api key | The key is not known. Check for typos and stray spaces. |
| 402 | No balance left. Please top up to continue using the API. | Your balance cannot cover the call. |
| 402 | Your trial has expired. Please upgrade to continue using the API. | The trial period ended before a top-up. |
| 403 | This API key is deactivated. Please contact support. | The key was turned off. |
| 403 | This endpoint is not included in your plan. | The key may not call this path. Trial keys cannot call /client/* and /premium/*. |
All error bodies are JSON objects with an error string. The full list is on Errors.
Account actions need more than the key
The account actions (/client/*, /premium/*) act on your own X account. Besides the API key they need the cookie of your X session and your own proxy in the JSON body. Read endpoints need only the key.