Twitter User Login API | Mint a Session

User Login mints an X session from a username, password, and an optional TOTP two-factor secret, returning the auth_token, ct0, and twid cookies. It is the convenience alternative to bringing your own cookies via Register Session, which stays the recommended path. The login call itself is a free session operation.

curl -X POST "https://example.com/user/user_login" \  -H "Content-Type: application/json" \  -d '{    "username": "string",    "password": "string"  }'

{  "auth_token": "abc123...",  "ct0": "def456...",  "twid": "u%3D44196397"}

{  "error": "bad_request",  "message": "Missing or malformed parameter. Fix the request before retrying."}

{  "error": "unauthorized",  "message": "The API key is missing, malformed, or revoked. Check the Authorization header."}

{  "error": "insufficient_credits",  "message": "Your balance is exhausted. Top up your credits to continue."}

{  "error": "forbidden",  "message": "The acting account is not authorized for this write action, or has no logged-in session."}

{  "error": "not_found",  "message": "The resource does not exist, for example a deleted tweet or a private account."}

{  "error": "rate_limited",  "message": "Too many requests. Back off and retry with exponential backoff."}

{  "error": "server_error",  "message": "Something failed on our side. Retry with backoff; if it persists, contact support."}

Pricing

When to use

Reach for User Login only when you cannot extract cookies from a logged-in browser and would rather hand over credentials. For anything you run on a schedule, prefer Register Session (POST /customer/session) with your own auth_token and ct0: it is the primary, most reliable path and never sends a password over the wire.

Related endpoints

• Register Session: Register your auth_token and ct0 cookies once so every write and private read acts as your account, or pass them per call as x-auth-token / x-ct0 headers.

FAQ

Should I use User Login or Register Session?

Register Session (POST /customer/session) is the recommended path: you bring your own auth_token and ct0 cookies, so no password is ever sent to the API. User Login is the convenience alternative for when you cannot extract cookies from a browser; it mints the same kind of session from a username and password.

What does User Login return?

The minted session cookies: auth_token, ct0, and twid. Register them via POST /customer/session, or send auth_token and ct0 as inline x-auth-token and x-ct0 headers on any private endpoint so one API key can act as many accounts.

Do I need a TOTP secret?

Only when the account has two-factor authentication enabled. Pass the base32 totp_secret and the API derives the current one-time code; omit it for accounts without 2FA.

How much does User Login cost?

Nothing. It is metered as a session operation, the same free class as Register Session. You pay only for the data reads and write actions you make with the resulting session.