Skip to main content

Migrate OAuth 1.0a user tokens to OAuth 2.0 with token exchange

By Steven Van ·

Developers can exchange stored OAuth 1.0a tokens for OAuth 2.0 access and refresh tokens without re-authorizing users.

Apps that already have users authenticated via OAuth 1.0a can now move them to OAuth 2.0 without sending them through a new consent screen. The X API accepts a token exchange grant, so a developer can send a user's stored OAuth 1.0a access token and secret to POST /2/oauth2/token with grant_type=urn:ietf:params:oauth:grant-type:token-exchange and get back an OAuth 2.0 access token and refresh token in return.

The scopes on the new token are derived from whatever permissions the user originally granted, and offline.access is included automatically so the refresh token works. Full details on the request format, the permission-to-scope mapping, rate limits, and error handling are in X's migration guide.

X
X
The real-time everything app — posts, news, and conversation, plus the X API and a hosted MCP server for connecting AI agents to real-time data.
View X →

Read the original announcement →

Read Migrate OAuth 1.0a user tokens to OAuth 2.0 with token exchange on Creators Toolbox