Authentication
Keys, headers and rate limits.
The key
A key looks like xd_live_ followed by 32 characters. It is shown once when created. Only a hash is stored on our side.
Send it in the x-api-key header, or as Authorization: Bearer xd_live_....
A key is tied to one wallet. Several keys can share a wallet, for example one per environment.
Rate limit
Each key has a requests-per-second limit set by the largest pack bought in the last 12 months.
| Pack | Requests per second |
|---|---|
| Free | 1 |
| Starter | 10 |
| Builder | 25 |
| Growth | 100 |
| Scale | 200 |
Above the limit the API answers 429 with a retry-after header. Nothing is charged.
Check a key
curl https://api.tweetapi.dev/v1/me -H "x-api-key: xd_live_..."{ "key_prefix": "xd_live_GPE4", "balance": 4895.5, "rate_limit_qps": 25 }Keep it secret
Never ship the key in a browser or a mobile app. Call the API from your server and put your own auth in front. A leaked key can be revoked; email hello@tweetapi.dev with the prefix.