X API Developer Account Approval: Pay-Per-Use Pricing, Read/Write Permissions, and What Replaced Elevated Access (2026)
On February 6, 2026, X replaced its old developer plans with pay-per-use as the default for new developers — no free tier, no subscription, credits deducted per request. If you are setting up API access for a business tool, bot, or SaaS integration, the pricing model, the permission structure, and X’s rejection categories all work differently than they did even a year ago.
What actually changed in February 2026
Per X’s own developer documentation, the X API now uses pay-per-usage pricing with no subscriptions required. Developers purchase credits upfront in the Developer Console, and those credits are deducted in real time as requests are made — there are no contracts, no subscriptions, and no minimum spend. This is now the default for any new developer account created today.
The old Free, Basic, and Pro subscription tiers still exist, but only for developers who already had them before the change — they are no longer offered to new sign-ups. Enterprise access (a much higher-volume, application-only track) remains separate and starts at a substantially higher monthly commitment. If your integration needs are modest, pay-per-use with a spending limit is usually the simpler starting point; if you already know you need sustained high volume, that is a different conversation. See our services pricing overview for how this fits alongside the other platforms we support.
What pay-per-use actually bills you for
Reading posts and data
Reading a post costs $0.005 per resource; reading user profiles, DMs, or follow relationships costs $0.010 per resource. Post reads are capped at 2 million per monthly billing cycle on pay-per-use before an Enterprise plan is needed.
Posting and write actions
Creating a post costs $0.015 per request — $0.200 if the post contains a link. Sending a DM or user interaction (follow, like) is billed at $0.015 per request as well.
Your own account costs less
“Owned Reads” — your own posts, bookmarks, followers, and lists — are billed at $0.001 per resource, a fraction of the cost of reading other accounts’ data. This matters a lot for dashboard and personal-analytics tools.
Deduplication and credits
Requesting the same resource twice within the same 24-hour UTC window is billed once, not twice. Credits are purchased in the Developer Console, auto-recharge can be enabled, and spend above certain thresholds earns cashback in free xAI API credits (up to 20% at $1,000+ cumulative spend per cycle).
Read, write, and DM permissions: what your app is actually allowed to do
For apps still using OAuth 1.0a, X defines three permission levels per app:
Read only
View posts, users, and public data. Cannot post, like, follow, or modify anything, and cannot access Direct Messages.
Read and write
All read permissions, plus posting and deleting posts, following/unfollowing, liking and reposting. Still cannot access Direct Messages.
Read, write, and Direct Messages
All read and write permissions, plus sending and reading Direct Messages — the highest permission level an app can request.
Changing an app’s permission level requires every existing user to re-authorize the app to receive tokens with the new scope — it does not apply retroactively. For new projects, X recommends OAuth 2.0 instead, which offers more fine-grained scopes and is required for v2 user-context endpoints; app types split into Web App and Automated App/Bot (confidential clients, with a client secret) versus Native App and Single Page App (public clients, PKCE only). Callback URLs must match exactly, use HTTPS in production, and are capped at 10 per app.
Where developer account and app requests actually get rejected
- The use case you write down is binding. Any real deviation from your stated use case without notifying X first can trigger enforcement action — and registering multiple apps for the same or substantially overlapping use case is against policy.
- Surveillance and tracking are prohibited outright. Using X data to investigate or track specific users, or to monitor sensitive events such as protests, rallies, or organizing activity, is a rules violation regardless of intent.
- Scraping and browser automation are banned for every app. Any attempt to pull X data outside the official API — scraping or browser automation — risks permanent suspension.
- Training AI or ML models on X content is prohibited. Since X updated its developer agreement, using X content to fine-tune or train a foundation or frontier model (other than X’s own Grok) is explicitly against the rules.
- Competitive benchmarking is explicitly disallowed. Measuring X’s availability, performance, functionality, or usage to compare against competitors is a named prohibited use.
- Spam and sensitive-data inference are both flagged. Sending unsolicited DMs, replies, or mentions, and deriving sensitive attributes like health, political, or religious information from X content, are both listed as restricted uses.
- Compliance rejections cannot be reopened. If a request is denied for violating the Developer Agreement, Automation Rules, or platform Rules, that decision is final. A pending (non-compliance) review can sometimes be continued by replying to X’s own review email.
How we approach an X API developer account setup
Scope the real use case first
What the app actually reads, writes, and posts gets written down before anything is created in the console — since that description becomes binding the moment the app is approved.
Choose the right permission and app type
Read-only versus read-and-write versus DMs, OAuth 2.0 versus 1.0a, confidential versus public client — matched to what the integration actually needs, not the widest access available.
Set up credentials and spend controls inside policy
Callback URLs, credit purchases, auto-recharge, and spending limits are configured together so the app cannot drift into a prohibited use case or an unbounded credit-balance drain.
Handle a rejection or suspension correctly
Since compliance-based rejections cannot be reopened, getting the submission right the first time matters more than appealing afterward; where a review is still pending, that means responding through X’s own channel the right way.
The exact wording, permission scoping, and setup sequence that gets an X API developer account through cleanly the first time is deliberately not spelled out here — that is the part of the work we do for clients.
What getting this wrong actually costs
- A compliance rejection is permanent. Per X’s own policy, a submission denied for violating the Developer Agreement, Automation Rules, or platform Rules has no formal appeal path.
- Suspension escalates with repetition. A suspended app can be appealed through X’s Platform Help Form, but repeated policy issues put the entire developer account at risk, not just one app.
- Uncontrolled usage bills your card, not the platform. Because pricing is pay-per-use, an unbounded loop or overly broad read pattern shows up as a draining credit balance rather than a simple rate-limit error — spend limits need to be set in advance, not reacted to afterward.
Frequently asked questions
Is there still a free tier for the X API?
No. As of February 6, 2026, new developer accounts start on pay-per-use pricing by default. Developers who already had Free, Basic, or Pro subscriptions keep them, but these plans are no longer offered to new sign-ups.
What is the difference between read and read-and-write app permissions?
Read-only apps can view public posts and data but cannot post, like, follow, or access Direct Messages. Read-and-write adds posting, following, and liking. The highest level adds Direct Message access. Changing permission levels requires users to re-authorize the app.
Does pay-per-use pricing apply to my own account's data?
Reading your own posts, bookmarks, followers, and lists (“Owned Reads”) is billed at a lower rate than reading other accounts’ data — a meaningful difference for dashboard or personal-analytics style tools.
Can a rejected or suspended X API application be appealed?
It depends on the reason. Rejections for policy or compliance violations are final. A pending review can sometimes be continued by replying to X’s own review email, and a suspended app can be appealed separately through X’s Platform Help Form.
Do I need OAuth 2.0 or OAuth 1.0a for a new integration?
X recommends OAuth 2.0 for new projects because it supports more fine-grained scopes and is required for v2 user-context endpoints. OAuth 1.0a remains available and uses the three-tier read/write/DM permission model instead.
Facts here are drawn from X’s own official developer documentation (docs.x.com and developer.x.com), reviewed July 2026. Pricing, permissions, and policy details change — verify against X’s current developer docs before building or budgeting around them. This is technical implementation guidance, not legal advice, and is not affiliated with or endorsed by X Corp. X makes all developer account, app approval, and enforcement decisions independently; no specific outcome, timeline, or cost can be guaranteed. See our full pricing overview and services for how X API setup fits alongside our Meta, Google, and LinkedIn API support. Questions? Reach out through the contact options in the footer.