Account Session

User Login

Log in to an X account with a username and password (plus a TOTP secret when two-factor authentication is enabled). The API runs the login itself and stores the resulting session server-side against your API key; authenticated-account reads and the write tools then act as that account. It does NOT return session cookies: the response is {ok, username, message}, never auth_token/ct0/twid. Bringing your own auth_token and ct0 via POST /customer/session stays the primary, recommended path, since it never sends a password over the wire. This call costs $0.01, billed only on a successful login; a rejected attempt (bad credentials, captcha, etc.) is never charged. Cost: $0.0100 per call.

post/user/user_login

Request

  • Base URL: https://api.twitterapis.com/twitter
  • URL: https://api.twitterapis.com/twitter/user/user_login
  • Auth: HTTP bearer

Request body

usernamestring required

The X account username or handle (without the leading @). Aliased as user_name for callers migrating from a twitterapi.io-shaped body.

passwordstring required

The X account password.

totp_secretstring

The base32 two-factor (TOTP) secret, required only when the account has 2FA enabled. The API derives the current one-time code from it; omit for accounts without 2FA.

proxy_urlstring

HTTP or SOCKS proxy the login itself runs through, for example http://user:pass@host:port. Optional; defaults to direct egress when omitted.

user_agentstring

Browser User-Agent sent for the login request. Optional; defaults to a current Chrome UA when omitted.

Response

Log in to X with a username and password (plus TOTP for 2FA) and store the resulting session against your API key, so authenticated-account reads and write tools then act as that account. A convenience alternative to bringing your own cookies via Register Session.

okboolean

True when the session was created and stored against your API key.

usernamestring

The X handle the session belongs to.

messagestring

Human-readable confirmation. On success: "Logged in. Private-data endpoints will now read as your account."

Changes

No recorded changes to this operation across all 1 revision of this API.