Migrate OAuth 1.0a user tokens to OAuth 2.0 with token exchange
By Steven Van ·
Developers can exchange stored OAuth 1.0a tokens for OAuth 2.0 access and refresh tokens without re-authorizing users.
Apps that already have users authenticated via OAuth 1.0a can now move them to OAuth 2.0 without sending them through a new consent screen. The X API accepts a token exchange grant, so a developer can send a user's stored OAuth 1.0a access token and secret to POST /2/oauth2/token with grant_type=urn:ietf:params:oauth:grant-type:token-exchange and get back an OAuth 2.0 access token and refresh token in return.
The scopes on the new token are derived from whatever permissions the user originally granted, and offline.access is included automatically so the refresh token works. Full details on the request format, the permission-to-scope mapping, rate limits, and error handling are in X's migration guide.
