Docs
Your X session (cookie)

Your X session (cookie)

What the cookie and proxy fields of the account actions need, how to copy the cookie in Chrome, Edge, Firefox or Safari, and how to keep the session working.

The account actions act on your own X account. Every call carries two fields: cookie, the session of a browser that is logged in to x.com, and proxy, the proxy the request to X goes out through.

CookieNeeded for
auth_tokenEvery account action. This is the login itself.
ct0Every account action.
twidDirect messages, and /client/likes without user_id.
guest_idOptional. Used when present.

Send them as one string, the way a browser sends its Cookie header:

auth_token=...; ct0=...; twid=u%3D1234567890

twid looks like u%3D1234567890. The number after u%3D is the account's user ID.

Log in to x.com with the account first. Then open the cookie list of https://x.com:

  • Chrome or Edge: open DevTools (F12, or Cmd+Option+I on a Mac), tab Application, then Cookies → https://x.com in the left column.
  • Firefox: open the developer tools (F12), tab Storage, then Cookies → https://x.com.
  • Safari: turn on the Develop menu in Safari's settings (Advanced), then Develop → Show Web Inspector, tab Storage, then Cookies.

Copy the Value of auth_token, ct0 and, if you need it, twid, and join them as shown above. auth_token does not show up in document.cookie, so copy it from this list.

The proxy

proxy is required on every call, in the form http://user:pass@host:port. The request to X goes out through it, so X sees the proxy's IP address. Use a proxy in the region the account usually logs in from, and keep the same proxy for the same account.

Keep the session working

  • Use a dedicated account rather than your main account. X can limit or suspend accounts that post, follow or like automatically.
  • Logging out of X in that browser ends the session, and the cookie stops working. Log in again and copy the new cookie.
  • Never share the cookie. Anyone who has it can use the account as you.