---
title: "Browser credential submit — agents should use /api/x-accounts/start instead"
method: POST
path: "/api/x-accounts/connect"
tags: ["Accounts"]
---

# Browser credential submit — agents should use /api/x-accounts/start instead

`POST /api/x-accounts/connect`

## Request

- Base URL: `https://twitr.sh`
- URL: `https://twitr.sh/api/x-accounts/connect`
- Auth: API key in header `SIGN-IN-WITH-X`

The browser form behind a connect link posts here; AGENTS CANNOT USE THIS. It REQUIRES a one-time token from POST /api/x-accounts/start, which is only delivered through the link the user opens — and the token is bound to the wallet that minted it, so a handle can never link to a different wallet. Use /api/x-accounts/start and give the user the link; never ask a user for their X password. Credentials arriving here are sealed in transit, relayed to the platform (encrypted at rest there), and never stored or logged by twitr.sh. Returns status=linked, or status=pending_code + challenge_id when an email code is needed (then /api/x-accounts/confirm). On 429 login_cooldown the account is temporarily paused: wait the Retry-After seconds, do NOT retry sooner (it extends the pause).

## Request body

- object
  - `username` string, required: X handle, no @.
  - `email` string, required: Email on the X account (may receive a verification code).
  - `password` string, required: X account password.
  - `totp_secret` string: REQUIRED if the account has 2FA: the authenticator secret key, not the 6-digit code.

## Response `200`

{handle, status: 'linked'} or {handle, status: 'pending_code', challenge_id}.

## Other responses

- `402`: Identity Required.
- `429`: Login temporarily paused (login_cooldown) — wait Retry-After seconds; retrying extends it.

---

[API](https://skmtc.dev/twitr/apis/twitr-sh.md) · [All operations](https://skmtc.dev/twitr/apis/twitr-sh/llms.txt) · [OpenAPI document](https://skmtc.dev/twitr/apis/twitr-sh/revisions/f6390fcee344?raw)