How to Automate X (Twitter) Post Scheduling using the API

API overview

Authentication

1. 1Create a Project and App at developer.x.com — new apps default to pay-per-use billing after February 2026
2. 2Enable OAuth 2.0 User Authentication in App settings with callback URL and required scopes
3. 3For media uploads, also generate OAuth 1.0a keys: API Key, API Secret, Access Token, Access Token Secret (all available in the Developer Portal)
4. 4Implement the PKCE flow: generate code_verifier, derive code_challenge (SHA-256), redirect user to authorization URL
5. 5After user grants access, exchange authorization code for access and refresh tokens
6. 6Store both OAuth 2.0 tokens (for posting) and OAuth 1.0a credentials (for media) securely

1import os
2import requests
3from requests_oauthlib import OAuth1
4
5# OAuth 2.0 token refresh (for text posts)
6def refresh_oauth2_token(refresh_token, client_id):
7    resp = requests.post(
8        'https://api.x.com/2/oauth2/token',
9        data={
10            'grant_type': 'refresh_token',
11            'refresh_token': refresh_token,
12            'client_id': client_id
13        }
14    )
15    return resp.json()  # {'access_token': '...', 'expires_in': 7200}
16
17# OAuth 1.0a auth object for media uploads
18def get_oauth1_auth():
19    return OAuth1(
20        os.environ['X_API_KEY'],
21        os.environ['X_API_SECRET'],
22        os.environ['X_ACCESS_TOKEN'],
23        os.environ['X_ACCESS_TOKEN_SECRET']
24    )

Key endpoints

1POST https://api.x.com/2/tweets
2Authorization: Bearer USER_ACCESS_TOKEN
3Content-Type: application/json
4
5{
6  "text": "Our weekly product update is live! Here's what's new this week."
7}

1{
2  "data": {
3    "id": "1790000000000000001",
4    "text": "Our weekly product update is live! Here's what's new this week."
5  }
6}

1# INIT
2POST https://api.x.com/2/media/upload
3Content-Type: application/x-www-form-urlencoded
4[OAuth 1.0a headers]
5
6command=INIT&total_bytes=204800&media_type=image%2Fjpeg
7
8# Response: {"media_id_string": "710511363345354753", ...}

1{
2  "media_id": 710511363345354753,
3  "media_id_string": "710511363345354753",
4  "expires_after_secs": 86400
5}

1DELETE https://api.x.com/2/tweets/1790000000000000001
2Authorization: Bearer USER_ACCESS_TOKEN

1{
2  "data": {
3    "deleted": true
4  }
5}

Step-by-step automation

1# No direct curl equivalent for the queue — use your database
2# Test that your scheduled post will work by posting immediately:
3curl -s -X POST 'https://api.x.com/2/tweets' \
4  -H 'Authorization: Bearer USER_ACCESS_TOKEN' \
5  -H 'Content-Type: application/json' \
6  -d '{"text": "Test post from scheduler"}'

1# Step 1: INIT
2curl -s -X POST 'https://api.x.com/2/media/upload' \
3  -H 'Authorization: OAuth oauth_consumer_key="...",oauth_token="...",oauth_signature_method="HMAC-SHA1",...' \
4  -d 'command=INIT&total_bytes=204800&media_type=image%2Fjpeg'
5
6# Step 2: APPEND (chunk 0)
7curl -s -X POST 'https://api.x.com/2/media/upload' \
8  -H 'Authorization: OAuth ...' \
9  -d 'command=APPEND&media_id=710511363345354753&segment_index=0&media_data=BASE64_CHUNK'
10
11# Step 3: FINALIZE
12curl -s -X POST 'https://api.x.com/2/media/upload' \
13  -H 'Authorization: OAuth ...' \
14  -d 'command=FINALIZE&media_id=710511363345354753'

1# Text-only post
2curl -s -X POST 'https://api.x.com/2/tweets' \
3  -H 'Authorization: Bearer USER_ACCESS_TOKEN' \
4  -H 'Content-Type: application/json' \
5  -d '{"text": "Your scheduled post text here"}'
6
7# Post with image
8curl -s -X POST 'https://api.x.com/2/tweets' \
9  -H 'Authorization: Bearer USER_ACCESS_TOKEN' \
10  -H 'Content-Type: application/json' \
11  -d '{"text": "Your post with image", "media": {"media_ids": ["710511363345354753"]}}'

1# Verify tweet was published and get metrics
2curl -s 'https://api.x.com/2/tweets/1790000000000000001?tweet.fields=public_metrics,created_at' \
3  -H 'Authorization: Bearer USER_ACCESS_TOKEN'

Complete working code

Complete tweet scheduler with SQLite queue, media upload support, cost tracking, and cron runner. Run via crontab (every minute) or as a daemon.

Error handling

Rate limits & throttling

Security checklist

Automation use cases

Best practices

• Calculate whether pay-per-use or Basic ($200/month) is cheaper before starting — the break-even point is about 13,333 text posts or 1,000 link posts per month
• Use the content_publishing_limit check equivalent — read x-user-limit-24hour-remaining on every tweet creation response to track toward the 2,400/day account cap
• Upload media before scheduled time (at least 1 hour earlier for videos) to decouple media processing delays from post timing
• Never post duplicate text — use a hash of the post content in your queue to detect and reject duplicates before attempting to post
• Add randomized timing variation of ±5 minutes to scheduled times to avoid looking like a bot posting at exactly :00 seconds
• For link posts ($0.20 each), use a URL shortener to reduce tweet character count but note: X counts t.co-wrapped URLs regardless of original length, and cost is based on URL presence not count

Ask AI to help

Copy one of these prompts to get a personalized, working implementation.

Related automations