Connect X account API & profile login workflow

{
  "id": "42",
  "xUserId": "9876543210",
  "xUsername": "elonmusk",
  "status": "active",
  "health": "healthy",
  "createdAt": "2025-01-15T12:00:00Z"
}

{
  "object": "x_account_connection_attempt",
  "id": "xatt_0123456789abcdef0123456789abcdef",
  "status": "pending",
  "pollAfterMs": 3000
}

{
  "error": "invalid_input",
  "message": "Invalid input. Check the request body."
}

{
  "error": "unauthenticated",
  "message": "Authentication required. Provide a valid API key or bearer token."
}

{
  "error": "account_already_connected",
  "message": "This X account is already connected."
}

{
  "error": "login_failed",
  "message": "Login failed. Check credentials and try again."
}

{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Retry later."
}

{
  "error": "x_user_lookup_failed",
  "message": "X username lookup failed. Try again later."
}

{
  "error": "service_unavailable",
  "message": "Service temporarily unavailable. Try again later."
}

POST

accounts

Connect X account API & profile login workflow

curl --request POST \
  --url https://xquik.com/api/v1/x/accounts \
  --header 'Content-Type: <content-type>' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "username": "<string>",
  "email": "<string>",
  "password": "<string>",
  "totp_secret": "<string>"
}
'

import requests

url = "https://xquik.com/api/v1/x/accounts"

payload = {
    "username": "<string>",
    "email": "<string>",
    "password": "<string>",
    "totp_secret": "<string>"
}
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "<content-type>"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'x-api-key': '<api-key>', 'Content-Type': '<content-type>'},
  body: JSON.stringify({
    username: '<string>',
    email: '<string>',
    password: '<string>',
    totp_secret: '<string>'
  })
};

fetch('https://xquik.com/api/v1/x/accounts', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://xquik.com/api/v1/x/accounts"

	payload := strings.NewReader("{\n  \"username\": \"<string>\",\n  \"email\": \"<string>\",\n  \"password\": \"<string>\",\n  \"totp_secret\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "<content-type>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "id": "<string>",
  "xUsername": "<string>",
  "xUserId": "<string>",
  "status": "<string>",
  "health": "<string>",
  "createdAt": "<string>",
  "object": "<string>",
  "pollAfterMs": 123,
  "expiresAt": "<string>",
  "message": "<string>",
  "username": "<string>"
}

Free - does not consume credits

Xquik encrypts credentials at rest. It only uses them to maintain the connection. Xquik never stores plaintext passwords.

Authenticator App 2FA and totp_secret are required for a durable Xquik connection. Missing the key? Restart Authentication App 2FA in X to reveal a new secret. Copy it, add it to your authenticator app, and finish X’s 6-digit confirmation. Then send the saved long key as totp_secret.

Custom, dedicated, and user-supplied proxies are not supported. Xquik does not guarantee one fixed public IP per connected account.

A connection can finish immediately, continue as a tracked attempt, or ask for an email code. If it continues, follow the returned Location. Do not send the credentials again while the attempt is pending.

curl -X POST https://xquik.com/api/v1/x/accounts \
  -H "x-api-key: xq_YOUR_KEY_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "your_x_username",
    "email": "account@example.invalid",
    "password": "<ACCOUNT_PASSWORD>",
    "totp_secret": "<TOTP_SECRET>"
  }' | jq

const response = await fetch("https://xquik.com/api/v1/x/accounts", {
  method: "POST",
  headers: {
    "x-api-key": "xq_YOUR_KEY_HERE",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    username: "your_x_username",
    email: "account@example.invalid",
    password: "<ACCOUNT_PASSWORD>",
    totp_secret: "<TOTP_SECRET>",
  }),
});
const data = await response.json();

import requests

response = requests.post(
    "https://xquik.com/api/v1/x/accounts",
    headers={"x-api-key": "xq_YOUR_KEY_HERE"},
    json={
        "username": "your_x_username",
        "email": "account@example.invalid",
        "password": "<ACCOUNT_PASSWORD>",
        "totp_secret": "<TOTP_SECRET>",
    },
)
data = response.json()

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
)

func main() {
    body, _ := json.Marshal(map[string]interface{}{
        "username":    "your_x_username",
        "email":       "account@example.invalid",
        "password":    "<ACCOUNT_PASSWORD>",
        "totp_secret": "<TOTP_SECRET>",
    })

    req, err := http.NewRequest("POST", "https://xquik.com/api/v1/x/accounts", bytes.NewReader(body))
    if err != nil {
        panic(err)
    }
    req.Header.Set("x-api-key", "xq_YOUR_KEY_HERE")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    var data map[string]interface{}
    if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
        panic(err)
    }
    fmt.Println(data)
}

X account connection result	Response source	Next step
Connected account ID	`id` from `201`	Use this ID for write actions and recovery.
X username	`xUsername`	Confirm the intended profile connected.
X user ID	`xUserId`	Preserve the stable account identity.
Connection state	`status`	Continue only after the account becomes active.
Login health	`health`	Require `healthy` before durable actions.
Pending attempt	`id` from `202 pending`	Poll the returned `Location` after `Retry-After`.
Email challenge	`id` from `202 requires_email_code`	Submit the matching email code before expiry.
Challenge expiry	`expiresAt`	Stop using an expired challenge.

Headers

string

required

Your API key. Session cookie authentication is also supported. Generate a key from the dashboard.

string

required

Must be application/json.

Body

string

required

X username to connect. The @ prefix is automatically stripped if included.

string

required

Email address associated with the X account.

string

required

Password for the X account. Encrypted at rest immediately upon receipt.

string

required

Authenticator App TOTP secret required for a durable connection. This is the base32-encoded secret, not the 6-digit code.

2FA secret key setup

Xquik needs the authenticator app secret key, not a live 6-digit code. The key is the long base32 string X shows while you set up Authentication App 2FA, for example JBSWY3DPEHPK3PXP.

Use the secret key

Paste the long base32 key into totp_secret. Xquik uses it to generate fresh 2FA codes during login challenges.

Do not use backup codes

Do not paste the 6-digit authenticator code, the 12-character backup code, a passkey, or a security key prompt.

If you already saved the secret key, send it as totp_secret. If you did not save it, create a fresh authenticator app secret on X:

You saved the key

Paste that saved base32 secret into totp_secret. Do not paste the current 6-digit authenticator code.

2FA is on, key is missing

X shows the text secret only during Authentication App setup. Turn Authentication App off, turn it on again, copy the new key, then finish setup on X.

2FA is not enabled

Start Authentication App setup on X, reveal the text secret, copy it, add it to your authenticator app, confirm the 6-digit code on X, then connect.

Open X Settings and Privacy > Security and Account Access > Security.
Open Two-Step Verification > Authentication App.
Turn Authentication App off.
Turn Authentication App on again.
When the QR code appears, choose Can’t scan the QR code? to reveal the text secret.
Copy the long secret key and store it safely before leaving the setup screen.
Add that key to your authenticator app if you are setting it up fresh.
Finish enabling 2FA on X by entering the current 6-digit code from your authenticator app.
Send the saved long key in totp_secret when you call Xquik.

Do not stop after copying the secret key. Complete the X-side 2FA confirmation before starting the Xquik connection, or the key will not work.

Passkeys and security keys cannot satisfy this flow. Use Authenticator App 2FA.

Response

201 Created

string

Unique account ID.

string

Connected X username.

string

X user ID.

string

Account connection status (e.g. "active").

string

Derived login/cookie health. One of healthy, locked, needsReauth, recovering, suspended, temporaryIssue. See Account health for meanings.

string

ISO 8601 timestamp of when the account was connected.

{
  "id": "3",
  "xUsername": "your_x_username",
  "xUserId": "9876543210",
  "status": "active",
  "health": "healthy",
  "createdAt": "2026-02-20T08:15:00.000Z"
}

202 Connecting

string

Always x_account_connection_attempt.

string

Connection attempt ID.

string

Always pending.

integer

Milliseconds to wait before checking the status URL.

{
  "object": "x_account_connection_attempt",
  "id": "xatt_0123456789abcdef0123456789abcdef",
  "status": "pending",
  "pollAfterMs": 3000
}

The response includes:

Location: /api/v1/x/account-connection-attempts/{id}
Retry-After: 3
Cache-Control: no-store

Wait for Retry-After, then call Get X Account Connection Status. Keep checking while status is pending. Do not create another attempt.

202 Email code required

string

Always x_account_connection_challenge.

string

Challenge ID to submit with the email verification code.

string

Always requires_email_code.

string

ISO 8601 expiration time for the challenge.

string

Human-readable next step.

string

X username being connected.

{
  "object": "x_account_connection_challenge",
  "id": "xch_8vGd8Y9JvH6dV0xA",
  "status": "requires_email_code",
  "expiresAt": "2026-05-08T12:10:00Z",
  "message": "Enter the email verification code to continue.",
  "username": "elonmusk"
}

Submit the code to Submit X Account Email Code.

400 Invalid input

{ "error": "invalid_input", "message": "Invalid input. Check the request body." }

Missing username, email, password, or totp_secret, or invalid field format.

401 Unauthenticated

{ "error": "unauthenticated", "message": "Missing or invalid API key" }

Missing or invalid API key.

409 Duplicate

{ "error": "account_already_connected", "message": "This X account is already connected." }

The specified X account is already connected to your Xquik account.

429 Rate limit exceeded

{ "error": "rate_limit_exceeded", "message": "Connection safety limit reached. Try again later.", "retryAfter": 900 }

The connection safety limit was reached. The response includes a Retry-After: 900 header indicating how many seconds to wait before retrying. See the rate limits guide for details.

{ "error": "login_cooldown", "message": "Login is temporarily paused", "reason": "automated", "retryAfterMs": 3600000 }

A prior login attempt triggered a cooldown (for example, X flagged the session). Wait for retryAfterMs before retrying. The response includes a Retry-After header in seconds.

{ "error": "login_failed", "message": "Login failed. Check credentials and try again.", "retryAfterMs": 300000 }

X rejected the submitted username, email, password, or TOTP secret. Retry with the current password and the saved Authenticator App secret key, not a 6-digit code. When retryAfterMs is present, wait for that exact duration. The response also includes Retry-After in seconds.

{
  "error": "passkey_required",
  "message": "Passkey verification is not supported. Use Authenticator app 2FA for this X account, then try again."
}

X asked for passkey verification. Switch the account to Authenticator App 2FA, save the long TOTP secret key, finish setup on X, then connect with totp_secret.

502 X user lookup failed

{ "error": "x_user_lookup_failed", "message": "X user not found. Check the username." }

The X username could not be resolved. Verify the handle is correct and that the account exists.

503 Service unavailable

{ "error": "service_unavailable", "message": "Service temporarily unavailable. Try again." }

The X connection service is temporarily unavailable. Retry after a short delay.

Related. Get X Account Connection Status for a pending attempt, List X Accounts to see connected accounts, or Re-authenticate if a connection expires later.

{
  "id": "42",
  "xUserId": "9876543210",
  "xUsername": "elonmusk",
  "status": "active",
  "health": "healthy",
  "createdAt": "2025-01-15T12:00:00Z"
}

{
  "object": "x_account_connection_attempt",
  "id": "xatt_0123456789abcdef0123456789abcdef",
  "status": "pending",
  "pollAfterMs": 3000
}

{
  "error": "invalid_input",
  "message": "Invalid input. Check the request body."
}

{
  "error": "unauthenticated",
  "message": "Authentication required. Provide a valid API key or bearer token."
}

{
  "error": "account_already_connected",
  "message": "This X account is already connected."
}

{
  "error": "login_failed",
  "message": "Login failed. Check credentials and try again."
}

{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Retry later."
}

{
  "error": "x_user_lookup_failed",
  "message": "X username lookup failed. Try again later."
}

{
  "error": "service_unavailable",
  "message": "Service temporarily unavailable. Try again later."
}

Connect X account API & profile login workflow

curl --request POST \
  --url https://xquik.com/api/v1/x/accounts \
  --header 'Content-Type: <content-type>' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "username": "<string>",
  "email": "<string>",
  "password": "<string>",
  "totp_secret": "<string>"
}
'

import requests

url = "https://xquik.com/api/v1/x/accounts"

payload = {
    "username": "<string>",
    "email": "<string>",
    "password": "<string>",
    "totp_secret": "<string>"
}
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "<content-type>"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'x-api-key': '<api-key>', 'Content-Type': '<content-type>'},
  body: JSON.stringify({
    username: '<string>',
    email: '<string>',
    password: '<string>',
    totp_secret: '<string>'
  })
};

fetch('https://xquik.com/api/v1/x/accounts', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://xquik.com/api/v1/x/accounts"

	payload := strings.NewReader("{\n  \"username\": \"<string>\",\n  \"email\": \"<string>\",\n  \"password\": \"<string>\",\n  \"totp_secret\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "<content-type>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "id": "<string>",
  "xUsername": "<string>",
  "xUserId": "<string>",
  "status": "<string>",
  "health": "<string>",
  "createdAt": "<string>",
  "object": "<string>",
  "pollAfterMs": 123,
  "expiresAt": "<string>",
  "message": "<string>",
  "username": "<string>"
}

Overview

X API

X write

Trends

Radar

Account

API keys

Guest wallets

Credits

X accounts

Monitors

Events

Webhooks

Draws

Extractions

Compose

Drafts

Styles

Support

Connect X account API & profile login workflow

Headers

Body

2FA secret key setup

Use the secret key

Do not use backup codes

You saved the key

2FA is on, key is missing

2FA is not enabled

Response

201 Created

202 Connecting

202 Email code required

400 Invalid input

401 Unauthenticated

409 Duplicate

429 Rate limit exceeded

502 X user lookup failed

503 Service unavailable

​Headers

​Body

​2FA secret key setup

Use the secret key

Do not use backup codes

You saved the key

2FA is on, key is missing

2FA is not enabled

​Response

​201 Created

​202 Connecting

​202 Email code required

​400 Invalid input

​401 Unauthenticated

​409 Duplicate

​429 Rate limit exceeded

​429 Login cooldown

​422 Login failed

​502 X user lookup failed

​503 Service unavailable

Headers

Body

2FA secret key setup

Response

201 Created

202 Connecting

202 Email code required

400 Invalid input

401 Unauthenticated

409 Duplicate

429 Rate limit exceeded

429 Login cooldown

422 Login failed

502 X user lookup failed

503 Service unavailable