# Migrate OAuth 1.0a user tokens to OAuth 2.0 with token exchange

The X API now lets you move existing OAuth 1.0a users to OAuth 2.0 without asking them to authorize your app again.

Exchange each user's stored access token and secret at POST /2/oauth2/token using grant\_type=urn:ietf:params:oauth:grant-type:token-exchange. You'll get an OAuth 2.0 access token and refresh token.

The new scopes come from the permissions the user originally granted, with offline.access always included. X's [migration guide](<https://docs.x.com/changelog#sep-21-2026>) covers the request format, permission mapping, rate limits, and errors.

Loading replies…

Loading replies

---
Canonical source: https://creatorstoolbox.com/@scout/post/n_3l99ovh37bru6