Zapier Twitter automation with webhooks & X API

Build Zapier Twitter automation through Xquik without an X Developer app. Search tweets, export followers, route webhooks, and approve write actions. Build a private Zapier Platform CLI integration. Add routes after Zap history confirms repeated demand.

Replace the retired Zapier Twitter integration

Zapier retired its native Twitter integration in 2023. Xquik restores those workflows through an API-key connection. Choose an Xquik connection based on the workflow:

API by Zapier

Use one reusable API-key connection for a small number of actions. Keep the Xquik key in the app connection instead of a Zap field.

Private platform integration

Use the CLI for shared actions, polling triggers, and REST Hooks. Add samples, output fields, custom errors, and shared field mapping.

Webhooks by Zapier

Use simple unauthenticated payloads only. Zapier keeps credentials in Webhooks step fields. People with Zap access can read them.

Search versus monitor

Search existing tweets with an action. Monitor new tweets, replies, quotes, or reposts with polling or signed webhook events.

This guide builds the private Platform integration.

Prerequisites

Xquik API key
Zapier account with Platform CLI access
A Node.js release supported by the current Zapier Platform CLI
HTTPS callback URLs for REST Hook testing

Install and sign in to the Zapier CLI:

npm install -g zapier-platform-cli
zapier-platform --version
zapier login
zapier init xquik-zapier --template minimal
cd xquik-zapier
npm install

Integration shape

Auth

API key field named apiKey, injected as x-api-key.

Base URL

https://xquik.com/api/v1

Request helper

JSON requests, structured Xquik errors, and Retry-After handling.

Actions

Search Tweets, Get User, Read Followers, Create Extraction, and Create Monitor. Add Create Webhook, Create Tweet, and Create Reply.

Triggers

New Matching Tweet polling and Monitor Event instant trigger. Add Extraction Completed and Webhook Delivery Failure polling.

API key auth

Add a custom auth field and inject it into every Xquik request:

const BASE_URL = "https://xquik.com/api/v1";

function addApiKeyHeader(request, z, bundle) {
  request.headers = request.headers || {};
  request.headers["x-api-key"] = bundle.authData.apiKey;
  return request;
}

async function testAuth(z) {
  const response = await z.request({
    method: "GET",
    url: `${BASE_URL}/account`,
  });

  return response.data;
}

module.exports = {
  authentication: {
    type: "custom",
    fields: [{ key: "apiKey", label: "Xquik API Key", required: true }],
    test: testAuth,
  },
  beforeRequest: [addApiKeyHeader],
};

Shared error handling

Normalize Xquik responses in one helper so every action reports the same remediation:

function throwForXquikError(z, response) {
  if (response.status < 400) {
    return;
  }

  const detail = response.data?.message || response.data?.error;

  if (response.status === 400) {
    throw new z.errors.Error(
      detail || "Invalid request. Fix the input fields.",
      "XquikInvalidRequest",
      400,
    );
  }

  if (response.status === 401) {
    throw new z.errors.RefreshAuthError("Authentication failed. Check the Xquik API key.");
  }

  if (response.status === 402) {
    throw new z.errors.Error(
      "Subscription or credits required. Update billing in Xquik.",
      "XquikBillingRequired",
      402,
    );
  }

  if (response.status === 404) {
    throw new z.errors.Error(
      detail || "Resource not found. Check the supplied ID.",
      "XquikResourceMissing",
      404,
    );
  }

  if (response.status === 424) {
    throw new z.errors.Error(
      detail || "X dependency failed. Retry only when the workflow is safe.",
      "XquikDependencyFailure",
      424,
    );
  }

  if (response.status === 429) {
    const retryAfter = Number.parseInt(
      response.getHeader?.("retry-after") || response.headers?.["retry-after"] || "",
      10,
    );

    if (Number.isInteger(retryAfter) && retryAfter > 0) {
      throw new z.errors.ThrottledError("Rate limited. Zapier scheduled a retry.", retryAfter);
    }

    throw new z.errors.Error(
      "Rate limited. Retry after the cooldown period.",
      "XquikRateLimit",
      429,
    );
  }

  if (response.status === 502) {
    throw new z.errors.Error(
      detail || "X retrieval failed. Retry with a bounded attempt count.",
      "XquikRetrievalFailure",
      502,
    );
  }

  throw new z.errors.Error(
    detail || "Xquik request failed. Inspect the safe status.",
    "XquikRequestError",
    response.status,
  );
}

async function xquikRequest(z, options) {
  const response = await z.request({
    ...options,
    skipThrowForStatus: true,
    throwForThrottlingEarly: false,
  });

  throwForXquikError(z, response);
  return response;
}

Call xquikRequest(z, options) before reading response data. Use each route’s response widget as the canonical status list.

Starter actions

Search tweets

Call GET /x/tweets/search with q. Use cursor for page loops. Keep limit on bounded resumes.

Get tweet

Call GET /x/tweets/{id} with a tweet ID.

Get user

Call GET /x/users/{id} with a username or numeric user ID.

Read followers

Call GET /x/users/{id}/followers. Preserve next_cursor between pages.

Read following

Call GET /x/users/{id}/following. Keep following rows separate.

Read tweet replies

Call GET /x/tweets/{id}/replies. Preserve parent and reply tweet IDs.

Get trends

Call GET /x/trends with optional woeid and count.

Create tweet

Call POST /x/tweets with account, text, and optional public media URLs.

Create reply

Call POST /x/tweets with account, text, and reply_to_tweet_id.

Create extraction

Call POST /extractions with toolType, query fields, and result limit.

Create monitor

Call POST /monitors with username and event types.

Create webhook

Call POST /webhooks with callback URL and event types.

Result handoff

Use Zapier samples and outputFields so later Zap steps map stable values. Use snake_case storage keys when direct API responses use camelCase. Return compact objects from actions and arrays from triggers.

Search tweets action

Return id, tweet_id, text, author_username, created_at, and url. Keep has_next_page and next_cursor when a Zap loops pages.

User profile rows

Return source id as user_id. Keep username, name, followers, verified, and profile_picture. Store the input, has_next_page, and next_cursor separately.

Follower and following rows

Store user_id, username, name, followers, following, verified, and profile_picture. Keep the source account, page cursor, and relationship direction.

Trend rows

Return each trend name, rank, query, and description. Keep response count, woeid, and the selected region with the Zap run.

Tweet or reply write

Send a unique Idempotency-Key. Store id, status, billing, result, and statusUrl. Poll while terminal is false. Retry only when safeToRetry is true, using a new key.

Media attachments

For tweets or replies, pass public URLs in media. Do not send media_ids. For DMs, upload first. Pass 1 media_id in media_ids. Store message_id and leave reply_to_message_id unset.

Monitor and webhook setup

Return monitor id, username, xUserId, eventTypes, isActive, and nextBillingAt. Return webhook id, url, eventTypes, and one-time secret. Map production deliveryId to delivery_id for receiver retry deduplication. Map streamEventId to stream_event_id for event deduplication across webhook changes.

REST hook trigger

Return id, delivery_id, and stream_event_id. Use delivery IDs for endpoint retries. Use event IDs across webhook changes.

Stored event replay

Call GET /events with cursor when a Zap needs replay. Map event and monitor IDs first. Then map occurredAt, hasMore, and nextCursor to snake_case fields.

Receiver acceptance

Zapier controls responses from its generated hook URL. Use a relay when you need custom acceptance or replay rules. Keep signing values, raw bodies, raw signatures outside Zap history. Keep full headers outside business apps too.

Extraction polling trigger

Return completed job id, toolType, and status. Store normalized IDs, status, has_more, and next_cursor. Then fetch detail rows.

Map friendly region names to WOEID values. Submit the selected value to Xquik. Example search action:

async function performSearchTweets(z, bundle) {
  const response = await xquikRequest(z, {
    method: "GET",
    url: `${BASE_URL}/x/tweets/search`,
    params: {
      q: bundle.inputData.q,
      queryType: bundle.inputData.queryType || "Latest",
      limit: bundle.inputData.limit || 25,
      cursor: bundle.inputData.cursor || undefined,
    },
  });

  const page = response.data;

  return (page.tweets || []).map((tweet) => ({
    id: tweet.id,
    tweet_id: tweet.id,
    text: tweet.text,
    author_username: tweet.author?.username || null,
    created_at: tweet.createdAt || null,
    url: tweet.url || null,
    has_next_page: Boolean(page.has_next_page),
    next_cursor: page.next_cursor || null,
  }));
}

module.exports = {
  key: "search_tweets",
  noun: "Tweet",
  display: {
    label: "Search Tweets",
    description: "Find recent tweets that match a search query.",
  },
  operation: {
    inputFields: [
      { key: "q", label: "Query", required: true, type: "string" },
      {
        key: "queryType",
        label: "Order",
        required: false,
        choices: ["Latest", "Top"],
      },
      { key: "limit", label: "Limit", required: false, type: "integer" },
      { key: "cursor", label: "Cursor", required: false, type: "string" },
    ],
    perform: performSearchTweets,
    sample: {
      id: "1840000000000000000",
      tweet_id: "1840000000000000000",
      text: "Example tweet text",
      author_username: "example_user",
      created_at: "2026-08-02T12:00:00Z",
      url: "https://x.com/example_user/status/1840000000000000000",
      has_next_page: true,
      next_cursor: "DAACCgACExample",
    },
    outputFields: [
      { key: "id", label: "Tweet ID" },
      { key: "tweet_id", label: "Tweet ID for Storage" },
      { key: "text", label: "Text" },
      { key: "author_username", label: "Author Username" },
      { key: "created_at", label: "Created At" },
      { key: "url", label: "URL" },
      { key: "has_next_page", label: "Has Next Page", type: "boolean" },
      { key: "next_cursor", label: "Next Cursor" },
    ],
  },
};

Trigger 1: new matching tweet

Poll searches for query alerts. Return stable tweet records with unique IDs.

async function performNewMatchingTweet(z, bundle) {
  return performSearchTweets(z, {
    ...bundle,
    inputData: {
      ...bundle.inputData,
      cursor: undefined,
      limit: 100,
      queryType: "Latest",
    },
  });
}

Return newest tweets first. Never reuse saved cursors across polling runs.

Trigger 2: monitor event REST hook

Use REST Hooks for near-real-time tweets, replies, quotes, and retweets.

Choose a secure webhook path

Use a verification relay. Keep the one-time signing secret outside Zapier logs.

Production relay

Let the relay create the Xquik webhook. Store its secret only in the relay. Verify HMAC, timestamp, nonce, delivery ID, and event ID there. Forward a normalized event to bundle.targetUrl after verification.

Direct private prototype

Use direct Zapier subscription only for isolated testing. The returned secret enters bundle.subscribeData and may enter Zapier HTTP logs. Never use this path when that exposure violates your secret policy.

async function subscribeHook(z, bundle) {
  const response = await xquikRequest(z, {
    method: "POST",
    url: `${BASE_URL}/webhooks`,
    body: {
      url: bundle.targetUrl,
      eventTypes: bundle.inputData.eventTypes,
    },
  });

  return {
    id: response.data.id,
    secret: response.data.secret,
    eventTypes: response.data.eventTypes,
  };
}

Zapier stores this result in bundle.subscribeData. Never expose the secret through trigger output. Use this path only for isolated testing.

Unsubscribe

async function unsubscribeHook(z, bundle) {
  const response = await xquikRequest(z, {
    method: "DELETE",
    url: `${BASE_URL}/webhooks/${bundle.subscribeData.id}`,
  });

  return response.data;
}

Direct prototype perform

const { createHmac, timingSafeEqual } = require("node:crypto");

const FIVE_MINUTES_MS = 5 * 60 * 1000;

function readRawHeader(headers, requestedName) {
  const wanted = requestedName.toLowerCase();

  for (const [name, value] of Object.entries(headers || {})) {
    const normalized = name.toLowerCase().replace(/^http-/, "");
    if (normalized === wanted) {
      return String(value);
    }
  }

  return "";
}

function verifyXquikWebhook(z, bundle) {
  const rawBody = bundle.rawRequest?.content;
  const headers = bundle.rawRequest?.headers;
  const secret = bundle.subscribeData?.secret;
  const timestamp = readRawHeader(headers, "x-xquik-timestamp");
  const nonce = readRawHeader(headers, "x-xquik-nonce");
  const signature = readRawHeader(headers, "x-xquik-signature");

  if (!rawBody || !secret || !timestamp || !nonce || !signature) {
    throw new z.errors.Error(
      "Webhook rejected. Signing fields are missing.",
      "XquikWebhookVerificationError",
      400,
    );
  }

  const timestampMs = Number(timestamp);
  if (!Number.isFinite(timestampMs) || Math.abs(Date.now() - timestampMs) > FIVE_MINUTES_MS) {
    throw new z.errors.Error(
      "Webhook rejected. Timestamp is stale or invalid.",
      "XquikWebhookVerificationError",
      400,
    );
  }

  const signingString = `${timestamp}.${nonce}.${rawBody}`;
  const expected = "sha256=" + createHmac("sha256", secret).update(signingString).digest("hex");
  const expectedBuffer = Buffer.from(expected);
  const actualBuffer = Buffer.from(signature);

  if (
    expectedBuffer.length !== actualBuffer.length ||
    !timingSafeEqual(expectedBuffer, actualBuffer)
  ) {
    throw new z.errors.Error(
      "Webhook rejected. Signature does not match.",
      "XquikWebhookVerificationError",
      400,
    );
  }

  return JSON.parse(rawBody);
}

function performMonitorEvent(z, bundle) {
  const payload = verifyXquikWebhook(z, bundle);

  return [
    {
      id: payload.streamEventId || payload.deliveryId || String(payload.timestamp),
      delivery_id: payload.deliveryId || null,
      stream_event_id: payload.streamEventId || null,
      event_type: payload.eventType,
      occurred_at: payload.occurredAt || payload.timestamp,
      username: payload.username || null,
      tweet_id: payload.data?.id || null,
      text: payload.data?.text || null,
      author_username: payload.data?.author?.userName || payload.username || null,
    },
  ];
}

Verify bundle.rawRequest.content before using bundle.cleanedRequest. Zapier prefixes most inbound raw headers with Http-; normalize that prefix. Zapier does not provide a durable 5-minute nonce store. Place a durable verification relay before Zapier in production. Verify HMAC, timestamps, and nonces there. Deduplicate deliveryId and streamEventId before forwarding. Zapier owns responses from bundle.targetUrl.

async function performList(z) {
  const response = await xquikRequest(z, {
    method: "GET",
    url: `${BASE_URL}/events`,
    params: { limit: 1 },
  });

  return (response.data.events || []).slice(0, 1).map((event) => ({
    id: event.id,
    delivery_id: null,
    stream_event_id: event.id,
    event_type: event.type,
    occurred_at: event.occurredAt,
    username: event.username || null,
    tweet_id: event.data?.id || null,
    text: event.data?.text || null,
    author_username: event.data?.author?.userName || event.username || null,
  }));
}

Testing a REST Hook calls performList, not the live perform handler.

Trigger 3: extraction completed

async function performCompletedExtractions(z) {
  const response = await xquikRequest(z, {
    method: "GET",
    url: `${BASE_URL}/extractions`,
    params: { status: "completed", limit: 25 },
  });

  return response.data.extractions || [];
}

Trigger 4: webhook delivery failure

async function performWebhookFailures(z, bundle) {
  const response = await xquikRequest(z, {
    method: "GET",
    url: `${BASE_URL}/webhooks/${bundle.inputData.webhookId}/deliveries`,
  });

  return (response.data.deliveries || []).filter((delivery) => delivery.status === "failed");
}

Build useful Zapier Twitter automation

Zapier Twitter Google Sheets

Search tweets with one saved query. Append IDs, text, authors, times, and URLs to Google Sheets. Resume with that query’s next_cursor.

Zapier Twitter to Slack

Verify each monitor event. Send normalized tweets, accounts, event types, and URLs to Slack in real time.

Zapier Twitter Discord

Send matched tweets or replies to Discord. Include the author, timestamp, tweet URL, and search query.

Zapier RSS to Twitter

Read blog posts from an RSS feed. Create approved scheduled tweets with the article title, URL, and campaign tags.

Zapier post to Twitter

Review the Twitter account, text, reply target, and media. Then run the approved write action with an idempotency key.

Followers to CRM

Use an automated workflow for bounded follower pages. Choose an extraction job for durable CSV, JSON, or XLSX exports.

Zapier Twitter Google Sheets workflows store searchable tweet rows. Zapier Twitter to Slack sends verified alerts in real time. Zapier Twitter Discord sends matched tweet notifications. Zapier RSS to Twitter converts blog posts from an RSS feed. Review scheduled tweets and the Twitter account before scheduling posts. Approve every Zapier post to Twitter step. Keep each automated workflow focused. Compare other Twitter automation tools before choosing.

Test coverage

Add focused Zapier tests before sharing the private app:

Auth header injection

Every request includes x-api-key from bundle.authData.apiKey.

Invalid key

401 returns “Authentication failed. Check the Xquik API key.”

Invalid input

400 returns the safe Xquik detail or an input-field remediation.

Billing required

402 tells the user to update subscription or credits.

Missing resource

404 identifies a bad tweet, user, monitor, webhook, or extraction ID.

Dependency failure

424 stops unsafe automatic retries and preserves a safe explanation.

Rate limit

429 creates ThrottledError with Retry-After when present.

Retrieval failure

502 uses a bounded retry policy outside unsafe write actions.

REST hook subscribe

The relay stores bundle.targetUrl, selected event types, and the secret.

REST hook unsubscribe

DELETE /webhooks/{id} uses bundle.subscribeData.id.

Sample output

performList and live perform return identical snake_case fields.

Search action

Search returns stable tweet IDs, authors, timestamps, URLs, and cursors.

Raw-Body signature

Changing one raw body byte makes HMAC verification fail.

Stale timestamp

A timestamp outside 5 minutes is rejected before JSON parsing.

Secret hygiene

Production Zapier output and logs never receive the Xquik signing secret.

Relay replay store

The relay rejects reused nonces and deduplicates delivery and event IDs.

Acknowledgement ownership

Relay tests cover custom 2xx rules. Zapier owns its hook URL response.

Run the local Zapier suite with:

zapier-platform test
zapier-platform validate

Zapier Twitter automation questions

How does a Zapier Twitter API connection work?

Yes. A private Platform app calls Xquik with one API key.

Why does the native Zapier Twitter integration not work?

Zapier retired it in 2023. Use a private Platform integration.

What does a Twitter Zapier workflow replace?

It replaces manual copying across tweet workflows.

Can Zapier search tweets by keyword?

Yes. Search with q; store tweet IDs and cursors.

Can Zapier export Twitter followers?

Yes. Page small lists; export larger ones.

Should a zap poll or use a Twitter webhook?

Poll delayed searches. Use signed hooks for live monitors.

How does Zapier verify an Xquik webhook?

Use a production relay. Verify HMAC over the raw body there. Check the timestamp and nonce before parsing JSON. Reject reused nonces. Deduplicate delivery and event IDs before forwarding events to Zapier.

Can Zapier post tweets and replies?

Yes. Use Zapier to automate tweets only after explicit approval.

Can Zapier schedule posts from an RSS feed?

Convert RSS items into scheduled tweets. Approve them before publishing.

Zapier and Xquik sources

Next steps

Read API Reference for statuses, Webhooks for verification, and Extraction Workflow for jobs.

​Replace the retired Zapier Twitter integration