---
title: "User Login"
method: POST
path: "/user/user_login"
tags: ["Account Session"]
---

# User Login

`POST /user/user_login`

## Request

- Base URL: `https://api.twitterapis.com/twitter`
- URL: `https://api.twitterapis.com/twitter/user/user_login`
- Auth: HTTP bearer

Log in to an X account with a username and password (plus a TOTP secret when two-factor authentication is enabled). The API runs the login itself and stores the resulting session server-side against your API key; authenticated-account reads and the write tools then act as that account. It does NOT return session cookies: the response is {ok, username, message}, never auth_token/ct0/twid. Bringing your own auth_token and ct0 via POST /customer/session stays the primary, recommended path, since it never sends a password over the wire. This call costs $0.01, billed only on a successful login; a rejected attempt (bad credentials, captcha, etc.) is never charged. Cost: $0.0100 per call.

## Request body

- object
  - `username` string, required: The X account username or handle (without the leading @). Aliased as user_name for callers migrating from a twitterapi.io-shaped body.
  - `password` string, required: The X account password.
  - `totp_secret` string: The base32 two-factor (TOTP) secret, required only when the account has 2FA enabled. The API derives the current one-time code from it; omit for accounts without 2FA.
  - `proxy_url` string: HTTP or SOCKS proxy the login itself runs through, for example http://user:pass@host:port. Optional; defaults to direct egress when omitted.
  - `user_agent` string: Browser User-Agent sent for the login request. Optional; defaults to a current Chrome UA when omitted.

## Response `200`

Log in to X with a username and password (plus TOTP for 2FA) and store the resulting session against your API key, so authenticated-account reads and write tools then act as that account. A convenience alternative to bringing your own cookies via Register Session.

- object
  - `ok` boolean: True when the session was created and stored against your API key.
  - `username` string: The X handle the session belongs to.
  - `message` string: Human-readable confirmation. On success: "Logged in. Private-data endpoints will now read as your account."

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `402`: Insufficient credits
- `409`: HTTP 409
- `422`: HTTP 422
- `429`: Rate limited
- `502`: HTTP 502
- `503`: HTTP 503

---

[API](https://skmtc.dev/twitterapis/apis/twitterapis-api.md) · [All operations](https://skmtc.dev/twitterapis/apis/twitterapis-api/llms.txt) · [OpenAPI document](https://skmtc.dev/twitterapis/apis/twitterapis-api/revisions/a33ce0fedb3c?raw)