Viewing: docs.x.com

Developer policies and guidelines for the X API, covering allowed use cases, restricted behaviors, compliance requirements, and best practices for apps.

Violations can result in app suspension, API access revocation, or permanent account bans. Always review the official policies before building.

Developer Agreement

Binding legal terms for API access

Developer Policy

Rules for building on X

Automation Rules

Specific rules for bots

Restricted Use Cases

Prohibited activities

Quick check: is my app allowed?

Before building, ask yourself these questions. If you answer no to any of them, your app likely violates Xs policies.

User Initiated?

For interactions, did the user explicitly request it?

Transparent?

Is your apps purpose and behavior clear to users? (Automated accounts must be labeled.)

Easy Opt-Out?

Can users easily opt out of any ongoing interactions?

Real Value?

Does it provide real value beyond self-promotion?

Official API Only?

Are you only using the official API (not scraping/browser automation)?

Within Limits?

Are you within rate limits and respecting usage policies?

When in doubt, ask: Would a user be happy with this experience? If not, reconsider your approach.

Common scenarios: allowed or not?

Real-world examples to help you understand whats permitted. These rules apply to all appswhether youre building a bot, mobile app, web integration, browser extension, analytics dashboard, or any other tool that uses the X API.

Scenario	Allowed?	Why
Automated account posts scheduled content (news, weather, quotes)	[]	Informational, no unsolicited mentions
App posts RSS feed updates on behalf of user	[]	Helpful broadcasting
Alert service posts earthquake/disaster notifications	[]	Public safety value
Sports app posts game updates to users timeline	[]	Informational
App posts stock/crypto prices on schedule	[]	Informational, no manipulation
App posts identical content across multiple accounts	[]	Spam / platform manipulation
App posts to trending topics to gain visibility	[]	Trend manipulation
Multiple city-specific alert accounts (e.g., @WeatherNYC, @WeatherLA)	[]	Allowednon-duplicative, location-specific content

Scenario	Allowed?	Why
App responds to @mentions asking for help	[]	User-initiated request
App auto-replies to anyone mentioning a keyword	[]	Unsolicited interaction
App auto-replies to users who reply to your post	[]	User engaged firstlimit 1 reply. Conditions apply
AI-powered app generates and posts replies	[]	Requires prior approval from X
App replies with follow me for more! to random users	[]	Spam, unsolicited
Utility app that unrolls threads when mentioned	[]	User-initiated utility

Scenario	Allowed?	Why
App responds to DMs with helpful info	[]	User-initiated
App sends affiliate links when user DMs first	[]	User-initiatedmust disclose. Conditions apply
App auto-DMs new followers with welcome message	[]	Unsolicited, even to followers
App bulk-DMs users about a product launch	[]	Spam
Support integration asks How can I help? after user DMs	[]	User-initiated conversation

Scenario	Allowed?	Why
Third-party app lets user tap a like button on a post	[]	User-initiated through the app
App auto-likes posts containing a hashtag	[]	Automated, not user-initiated
Mobile app has auto-like feature for selected users	[]	Automated, not user-initiated
Service sells likes or offers bulk like packages	[]	Selling engagement is prohibited
App reposts content from a curated list	[]	OK for informational purposes, no bulk spam. Conditions apply
Growth tool bulk-follows accounts to grow audience	[]	Manipulation
App follows back anyone who follows it	[]	Bulk/aggressive following
App adds users to lists in bulk	[]	Indiscriminate list manipulation

Likes must be directly initiated by the authenticated user. Automated, bulk, or indiscriminate liking including auto-liking by keyword, hashtag, user, or schedule is prohibited. Apps may not offer auto-like features or sell likes as a service. This applies to all appsbots, mobile apps, browser extensions, or any integration.

Scenario	Allowed?	Why
App sends product recommendations when asked	[]	User-initiated
App replies to random posts with affiliate links	[]	Unsolicited spam
Giveaway app that requires follows/retweets to enter	[]	Riskycan be seen as engagement manipulation
Service selling likes/follows/retweets	[]	Strictly prohibited
Tip service that sends crypto when user requests	[]	User-initiatedcomply with financial regulations. Conditions apply

Scenario	Allowed?	Why
App tracks brand mentions for analytics dashboard	[]	Valid use case
App scrapes X via browser automation (not API)	[]	Permanent suspensionAPI only
App stores X data to train AI/ML models	[]	Prohibited (except Grok)
App redistributes >1.5M posts in 30 days	[]	Exceeds redistribution limits
App benchmarks X performance vs competitors	[]	Prohibited competitive analysis
Academic research on public conversation trends	[]	Valid with proper data handling

Non-API automation (scraping, browser automation) results in permanent suspension. Always use the official X API.

Prohibited activities

These activities will get your app suspended or permanently banned. There are no exceptions.

Category	Examples
Spam & Manipulation	Identical content across accounts, fake engagement, trend manipulation, bulk posting
Unsolicited Outreach	Auto-replies to random users, bulk DMs, uninvited @mentions
Deceptive Bots	Impersonating humans, hiding bot identity, misleading links/redirects
Engagement Selling	Apps that sell likes, follows, retweets, or views
Rate Limit Abuse	Exceeding limits, designing apps that encourage overuse
Non-API Automation	Browser scripting, scraping, any automation outside official API
Account Farms	Multiple accounts for same duplicative purpose
Surveillance	Profiling, tracking, or monitoring users without consent
Unauthorized AI Training	Using X data to train ML models (Grok excepted)
Sensitive Data Derivation	Inferring health, political, religious, or other sensitive attributes
Excessive Redistribution	Sharing >1.5M Post IDs per 30-day period

Automation rules

This section applies specifically to automated accounts (bots) that post, reply, or interact on behalf of users. If youre building an analytics dashboard, research tool, or other non-automated app, these labeling requirements dont apply to youbut the technical restrictions still do.

Requirements for automated accounts

All automated accounts using the X API must meet these requirements:

Enable the 'Automated' profile label

This label appears under your bots name/handle on its profile. Enable it in your app settings to ensure transparency.

Disclose in bio

State clearly that its a bot and who operates it. Example: Bot by @yourcompany or Automated account managed by Example Inc.

Link to a human-managed account

For accountability and contact purposes, your bot must be associated with a human-managed account.

Honor opt-out requests immediately

If a user says stop, stop. Implement keyword detection for common opt-out phrases.

Use only the official X API

No scraping, browser automation, or unofficial methods. Violations result in permanent suspension.

Stay within rate limits

Dont try to circumvent or abuse rate limits. Design your app to handle limits gracefully.

Automated actions: whats allowed?

Action	Allowed?	Rules
Post tweets	[]	No unsolicited @mentions. No identical cross-posting.
Reply to users	[]	Only if user engaged first. Max 1 reply per interaction.
Send DMs	[]	Only after user DMs you first. Easy opt-out required.
Like posts	[]	Must be directly user-initiated. Auto-liking, bulk liking, and selling likes are prohibited.
Repost	[]	OK for informational/entertainment. No bulk spam.
Quote tweet	[]	Same rules as repostno spam or manipulation.
Follow/Unfollow	[]	No bulk, aggressive, or automated following.
Add to Lists	[]	No bulk or indiscriminate additions.
Bookmark	[]	Fine for personal/automated use.
Search/Read	[]	Standard use within rate limits.

Gray areas explained

Many developers have questions about edge cases. Heres guidance on common gray areas.

Affiliate Links & Promotions

Allowed if:

User explicitly requests it (e.g., DMs asking for a recommendation)
You clearly disclose the affiliate/sponsored relationship
Links are not misleading (no deceptive redirects)

Not allowed if:

You auto-reply to random posts with affiliate links
You DM users who didnt ask
You hide the commercial relationship

AI-Generated Content & Replies

Requires prior approval from X before deployment
Must still follow all rules (no unsolicited mentions, properly labeled)
Contact X via the Policy Support form before launching
Even with approval, cannot impersonate humans

Deploying AI-generated replies without approval is a violation, even if the content itself is helpful.

[]

Welcome Messages to New Followers

Not allowed as automated DMsthis counts as unsolicited contact, even though they followed you.Alternatives:

Pinned tweet welcoming new followers
Bio with intro info and links
Auto-reply only if they DM you first

Multiple Accounts / Regional Bots

Allowed if:

Each account serves non-duplicative purposes (e.g., @EarthquakeJP, @EarthquakeCA)
Content is meaningfully different (location-specific, language-specific)
Not used to bypass limits or amplify the same message

Not allowed if:

Posting identical/similar content across accounts
Created to evade suspensions or rate limits

Customer Support Automation

Allowed if:

User initiates (mentions you, DMs you, or explicitly opts in)
Clear opt-out mechanism exists
Responses are helpful, not promotional
Includes privacy policy link in DMs

Not allowed if:

You reach out to users who complained publicly (unsolicited)
Responses are primarily promotional

Giveaways & Contests

Proceed with caution:

Requiring follows/retweets as entry can be seen as engagement manipulation
Must comply with Xs contest guidelines
Dont use multiple accounts to amplify
Ensure prizes are real and delivered

Consider entry methods that dont require engagement actions, like replying with a specific phrase.

Data handling and display requirements

These requirements are legally binding under the Developer Agreement. Non-compliance can result in termination and legal action.

Content deletion

You must delete X Content from your systems when requested:

Trigger	Deadline
X requests deletion	24 hours
User requests deletion	24 hours
Content is suspended/removed on X	24 hours
Your API access is terminated	10 business days (must delete all X data)

Use Compliance Firehose to receive real-time deletion events and stay compliant automatically.

Off-X matching

Off-X matching means associating X data (username, user ID, posts) with off-platform identifiers (your customer database, email lists, device IDs, etc.).

Allowed with express opt-in consent:

User explicitly agrees to link their X account with your service
Clear disclosure of what data will be matched and why

Without consent, you may only match:

Information the user directly provided to you
Publicly available X data (posts, bio, display name, username)
Public resources like professional directories

Never match if it would surprise the user.

Sensitive data

You cannot derive, infer, or store information about X users in these categories:

Category	Examples
Health	Medical conditions, pregnancy, disabilities
Financial status	Negative financial condition, credit issues
Political	Party affiliation, political beliefs, voting
Racial/Ethnic	Origin, ethnicity
Religious/Philosophical	Beliefs, affiliations
Sex life/Sexual orientation	Any inference about sexuality
Trade union	Membership or affiliation
Criminal	Alleged or actual criminal activity

Exception: Aggregate analysis without storing personal identifiers (no user IDs, usernames, or linkable data) may be allowed for research purposes, subject to applicable laws.

Displaying X content

Requirement	Details
Attribution	Use proper X branding. Follow Brand Guidelines.
No alterations	Only modify for display formatting (resizing). Dont edit content, remove timestamps, or strip metadata.
No iframes	Dont display X Content in iframes. Use official embeds or render directly.
Respect removals	Remove content within 24 hours if deleted on X.

Technical restrictions

These limits apply to all developers. Exceeding them can result in rate limiting or suspension.

Restriction	Limit
Post ID redistribution	Max 1.5M Post IDs per 30-day period to any single entity
Hydrated content redistribution	Max 50,000 hydrated Posts or Users per recipient per day
Rate limits	Vary by endpoint and tiersee API docs
AI/ML training	Prohibited (except for Grok)
Non-API access	Prohibitedscraping and browser automation = permanent ban
Competitive benchmarking	Prohibitedcant measure X performance vs. competitors
Multiple apps for same use case	Prohibiteddont create duplicate apps to bypass limits

Special use cases

Use Case	Requirement
Government use	Requires Enterprise tier
Commercial use	Requires appropriate paid tier; free tier is non-commercial only
Academic research	May have different redistribution limits; contact X for details
EU Digital Services Act research	Specific non-commercial research provisions available

Security and compliance

Your obligations as a developer:

[]

Security Requirements

Use industry-standard security practices to protect X data
Never share your API credentials or tokens
Store credentials securely (environment variables, secret managersnot in code)
Implement proper authentication in your apps

[]

Breach Notification

If you experience a security breach involving X data:

Notify X immediately
Take steps to mitigate the breach
Cooperate with Xs investigation

Confidentiality

Treat any non-public information from X as confidential
Dont disclose API rate limits, internal X data, or non-public features
Dont use confidential info for competitive purposes

[]

Audit Rights

X may audit your compliance up to once per year
You must provide reasonable access and documentation
Keep records of how you use X data

Summary: dos and donts

[] Do
[] Don't

For Automated Accounts:

Enable Automated profile label
Disclose operator in bio
Wait for users to initiate interaction
Provide easy opt-out
Get approval for AI-generated replies

For All Apps:

Use only the official X API
Respect rate limits and redistribution limits
Delete content within 24 hours when requested
Get opt-in consent for off-X matching
Use proper attribution when displaying X Content
Secure your credentials and notify X of breaches
Keep records of your X data usage

Getting Started

Products

Fundamentals

Partners & Customers

Resources

Developer Guidelines

Developer Agreement

Developer Policy

Automation Rules

Restricted Use Cases

Quick check: is my app allowed?

User Initiated?

Transparent?

Easy Opt-Out?

Real Value?

Official API Only?

Within Limits?

Common scenarios: allowed or not?

Prohibited activities

Automation rules

Requirements for automated accounts

Automated actions: whats allowed?

Gray areas explained

Data handling and display requirements

Content deletion

Off-X matching

Sensitive data

Displaying X content

Technical restrictions

Special use cases

Security and compliance

Summary: dos and donts

On this page