X account reauthentication API & login recovery

{
  "id": "42",
  "xUserId": "9876543210",
  "xUsername": "elonmusk",
  "status": "active",
  "health": "healthy",
  "createdAt": "2025-01-15T12:00:00Z"
}

{
  "error": "invalid_input",
  "message": "Invalid input. Check the request body."
}

{
  "error": "unauthenticated",
  "message": "Authentication required. Provide a valid API key or bearer token."
}

{
  "error": "account_not_found",
  "message": "X account not found."
}

{
  "error": "login_failed",
  "message": "Login failed. Check credentials and try again."
}

{
  "error": "login_cooldown",
  "message": "Login is temporarily paused"
}

{
  "error": "service_unavailable",
  "message": "Service temporarily unavailable. Try again later."
}

POST

accounts

{id}

reauth

X account reauthentication API & login recovery

curl --request POST \
  --url https://xquik.com/api/v1/x/accounts/{id}/reauth \
  --header 'Content-Type: <content-type>' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "password": "<string>"
}
'

import requests

url = "https://xquik.com/api/v1/x/accounts/{id}/reauth"

payload = { "password": "<string>" }
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "<content-type>"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'x-api-key': '<api-key>', 'Content-Type': '<content-type>'},
  body: JSON.stringify({password: '<string>'})
};

fetch('https://xquik.com/api/v1/x/accounts/{id}/reauth', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://xquik.com/api/v1/x/accounts/{id}/reauth"

	payload := strings.NewReader("{\n  \"password\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "<content-type>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "id": "<string>",
  "xUsername": "<string>",
  "xUserId": "<string>",
  "status": "<string>",
  "health": "<string>",
  "createdAt": "<string>"
}

Free. This endpoint does not consume credits.

Use this when an account session expires or X requires re-verification.

Omit totp_secret to reuse the saved key. Send a replacement only if X changed or rejected the saved key. Re-authentication does not guarantee the same public IP. Xquik does not support custom, dedicated, or user-supplied proxies.

curl -X POST https://xquik.com/api/v1/x/accounts/3/reauth \
  -H "x-api-key: xq_YOUR_KEY_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "password": "<ACCOUNT_PASSWORD>"
  }' | jq

const accountId = "3";
const response = await fetch(`https://xquik.com/api/v1/x/accounts/${accountId}/reauth`, {
  method: "POST",
  headers: {
    "x-api-key": "xq_YOUR_KEY_HERE",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    password: "<ACCOUNT_PASSWORD>",
  }),
});
const data = await response.json();

import requests

account_id = "3"
response = requests.post(
    f"https://xquik.com/api/v1/x/accounts/{account_id}/reauth",
    headers={"x-api-key": "xq_YOUR_KEY_HERE"},
    json={
        "password": "<ACCOUNT_PASSWORD>",
    },
)
data = response.json()

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
)

func main() {
    body, _ := json.Marshal(map[string]interface{}{
        "password": "<ACCOUNT_PASSWORD>",
    })

    accountID := "3"
    req, err := http.NewRequest("POST", "https://xquik.com/api/v1/x/accounts/"+accountID+"/reauth", bytes.NewReader(body))
    if err != nil {
        panic(err)
    }
    req.Header.Set("x-api-key", "xq_YOUR_KEY_HERE")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    var data map[string]interface{}
    if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
        panic(err)
    }
    fmt.Println(data)
}

Replace the saved TOTP secret

Send totp_secret only when the saved key no longer works.

cURL

curl -X POST https://xquik.com/api/v1/x/accounts/3/reauth \
  -H "x-api-key: xq_YOUR_KEY_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "password": "<ACCOUNT_PASSWORD>",
    "totp_secret": "<REPLACEMENT_TOTP_SECRET>"
  }' | jq

X account recovery column	Request or response source	Recovery rule
Account ID	Path `{id}` and response `id`	Require both IDs to match.
Current password	Request `password`	Send it only to this reauthentication request.
Saved TOTP key	Omitted `totp_secret`	Reuse the stored authenticator secret.
Replacement TOTP key	Request `totp_secret`	Send the base32 key, never a 6-digit code.
X username	Response `xUsername`	Confirm the recovered profile.
X user ID	Response `xUserId`	Store it. It stays the same when the username changes.
Account state	Response `status`	Require `active` before write actions.
Login health	Response `health`	Require `healthy` before durable actions.

Path parameters

string

required

The unique account ID.

Headers

string

required

Your API key. Session cookie authentication is also supported. Generate a key from the dashboard.

string

required

Must be application/json.

Body

string

required

Current password for the X account.

string

Replacement Authenticator App TOTP secret. Omit it to reuse the saved key. Send the base32 secret, not the 6-digit code.

string

Email for the X account. Updates the stored email during re-authentication.

2FA re-authentication

Xquik reuses the saved TOTP secret by default. Send totp_secret only when replacing that key. Never send a 6-digit code, backup code, passkey, or security key prompt. If you never saved the secret key, or X rejects the current one, reset the authenticator app setup before re-authenticating:

Saved key still works

Omit totp_secret. Xquik reuses the encrypted key saved during connection.

Key is missing

X shows the text secret only during Authentication App setup. Turn Authentication App off, then on again. Copy the new key, then finish setup on X.

Key was rejected

Treat the old TOTP secret as stale. Reset Authentication App setup on X and save the new long key. Finish 2FA confirmation, then re-authenticate.

Open X Settings and Privacy > Security and Account Access > Security.
Open Two-Step Verification > Authentication App.
Turn Authentication App off, then turn it on again.
When the QR code appears, choose Can’t scan the QR code? to reveal the text secret.
Copy the long secret key and store it in a password manager before leaving the setup screen.
Add that key to your authenticator app if you are setting it up fresh.
Finish enabling 2FA on X by entering the current 6-digit code from your authenticator app.
Send the new long key in totp_secret when you call Xquik.

Finish the X-side 2FA confirmation after copying the secret key. If you abandon setup before confirmation, re-authentication cannot use that key.

See 2FA secret key setup for the full connection checklist.

Response

200 OK

string

Account ID.

string

X username.

string

X user ID.

string

Account status (for example active).

string

Derived login and cookie health. One of healthy, locked, needsReauth, recovering, suspended, temporaryIssue. See Account health for meanings.

string

ISO 8601 creation timestamp.

{
  "id": "3",
  "xUsername": "elonmusk",
  "xUserId": "44196397",
  "status": "active",
  "health": "healthy",
  "createdAt": "2026-02-20T08:15:00.000Z"
}

400 Invalid input

{ "error": "invalid_input", "message": "Missing required password field" }

Missing password field or invalid format.

{ "error": "invalid_id", "message": "Invalid account ID format" }

The provided account ID is not a valid format.

401 Unauthenticated

{ "error": "unauthenticated", "message": "Missing or invalid API key" }

Missing or invalid API key.

404 Not found

{ "error": "account_not_found", "message": "X account not found." }

No account exists with this ID, or it belongs to a different Xquik account.

{
  "error": "login_cooldown",
  "message": "Login is temporarily paused",
  "reason": "automated",
  "retryAfterMs": 3600000
}

A prior login attempt triggered a cooldown (for example, X flagged the session). Wait for retryAfterMs before retrying. The response includes a Retry-After header in seconds.

429 Rate limited

{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Try again later.",
  "retryAfter": 60
}

Wait for the Retry-After value before starting another re-authentication request.

{ "error": "login_failed", "message": "Login failed. Check credentials and try again." }

X rejected the submitted password or TOTP secret. Retry with the current password and the saved Authenticator App secret key, not a 6-digit code.

{
  "error": "passkey_required",
  "message": "X asked this account to sign in with a passkey. Delete the passkey in X's security settings, keep Authentication app 2FA, then try again."
}

X showed this account a passkey sign-in, which Xquik can’t complete. Delete the passkey in X Settings and Privacy > Security and Account Access > Security > Passkey, keep Authenticator App 2FA on, then re-authenticate.

503 Service unavailable

{ "error": "service_unavailable", "message": "Service temporarily unavailable. Try again." }

The X re-authentication service is temporarily unavailable. Retry after a short delay.

Related. Get X Account to check account status, or Connect X Account if you need to add a new account instead.

{
  "id": "42",
  "xUserId": "9876543210",
  "xUsername": "elonmusk",
  "status": "active",
  "health": "healthy",
  "createdAt": "2025-01-15T12:00:00Z"
}

{
  "error": "invalid_input",
  "message": "Invalid input. Check the request body."
}

{
  "error": "unauthenticated",
  "message": "Authentication required. Provide a valid API key or bearer token."
}

{
  "error": "account_not_found",
  "message": "X account not found."
}

{
  "error": "login_failed",
  "message": "Login failed. Check credentials and try again."
}

{
  "error": "login_cooldown",
  "message": "Login is temporarily paused"
}

{
  "error": "service_unavailable",
  "message": "Service temporarily unavailable. Try again later."
}

X account reauthentication API & login recovery

curl --request POST \
  --url https://xquik.com/api/v1/x/accounts/{id}/reauth \
  --header 'Content-Type: <content-type>' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "password": "<string>"
}
'

import requests

url = "https://xquik.com/api/v1/x/accounts/{id}/reauth"

payload = { "password": "<string>" }
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "<content-type>"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'x-api-key': '<api-key>', 'Content-Type': '<content-type>'},
  body: JSON.stringify({password: '<string>'})
};

fetch('https://xquik.com/api/v1/x/accounts/{id}/reauth', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://xquik.com/api/v1/x/accounts/{id}/reauth"

	payload := strings.NewReader("{\n  \"password\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "<content-type>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "id": "<string>",
  "xUsername": "<string>",
  "xUserId": "<string>",
  "status": "<string>",
  "health": "<string>",
  "createdAt": "<string>"
}

Overview

X API

X write

Trends

Radar

Account

API keys

Guest wallets

Credits

X accounts

Monitors

Events

Webhooks

Draws

Extractions

Compose

Drafts

Styles

Support

X account reauthentication API & login recovery

Path parameters

Headers

Body

2FA re-authentication

Saved key still works

Key is missing

Key was rejected

Response

200 OK

400 Invalid input

401 Unauthenticated

404 Not found

429 Rate limited

503 Service unavailable

​Path parameters

​Headers

​Body

​2FA re-authentication

Saved key still works

Key is missing

Key was rejected

​Response

​200 OK

​400 Invalid input

​401 Unauthenticated

​404 Not found

​429 Login cooldown

​429 Rate limited

​422 Login failed

​503 Service unavailable

Path parameters

Headers

Body

2FA re-authentication

Response

200 OK

400 Invalid input

401 Unauthenticated

404 Not found

429 Login cooldown

429 Rate limited

422 Login failed

503 Service unavailable