xiry.

Development · Framework

Accessing X Internal API via Session Tokens

Tutorial explaining session token replay for internal X API access

From the Xiry library · Updated 11 October 2026

A 12-part tutorial by Denislav Gavrilov demonstrating how web scrapers and automation bots interact with internal X endpoints. It covers extracting active session credentials from browser DevTools, replaying them in API requests, and managing session persistence with a local browser bridge.

The framework

Key points:

  • Two ways to bot: website API vs browser automation (selenium/puppeteer); API is faster and more flexible.
  • Session persistence via cookies is the unfixable flaw: get auth_token, csrf token, bearer token and replay them in a curl request; against Bearer-auth sites there is little they can do without a concentrated security effort.
  • For X specifically: bearer + auth_token + ct0 gives full free access to the official API.
  • Exact request pattern: curl -s "https://x.com/i/api/2/timeline/conversation/${TID}.json?tweet_mode=extended&count=40" -H "Authorization: Bearer $BEARER" -H "x-csrf-token: $CT0" -H "x-twitter-auth-type: OAuth2Session" -H "x-twitter-active-user: yes" -H "cookie: auth_token=$AUTH_TOKEN; ct0=$CT0" | jq
  • Token refresh problem handled by "browser bridging": a local Node bridge (bridge.js on localhost:3000) keeps the session live; built by reverse engineering (rev-eng folder, files legacy.json, twotab_cli.py).
  • Demonstrated builds: a browser extension and a terminal client for X.

What it's for

  • Study how session tokens and cookies are replayed for programmatic web access
  • Compare the efficiency of direct API requests against browser automation tools
  • Implement browser bridge mechanisms to maintain long-lived automation sessions

Key points

  • Comparison between browser automation (Puppeteer/Selenium) and direct API interactions
  • Identification of key authentication values including auth_token, ct0, and bearer tokens
  • Header structure and endpoint mapping for internal timeline and conversation routes
  • Implementation of a local Node.js bridge to manage session renewal
  • Example implementations including a browser extension and a terminal-based client

Pricing

Free

Details

Type
Framework
Category
Development
Topic
API Automation
Platforms
API, Command line, Browser extension
For
Developers and security researchers studying web automation and API authentication patterns
Alternative to
Official X API, Puppeteer, Playwright
Tags
api, reverse engineering, authentication, web scraping, twitter, automation

Why it was saved

  • @kuberdenis, 6 May 2025: Explains the general session-hijacking exploit that unfixably enables bots, plus the exact request-header pattern for the X API V2 conversation endpoint.

Compare

Related

  • Parse

    Turn any website into a structured REST API using natural language

  • Hyperbrowser

    Cloud browser infrastructure and automation agents designed for AI applications.

  • API Anything

    Turn websites into plain HTTP APIs for AI agents to call directly.

  • Cloudflare /crawl Endpoint

    Single API endpoint to crawl entire websites to Markdown, HTML, or JSON

  • Enabling FIRE-1 in the Firecrawl Scrape API

    API configuration pattern for Firecrawl's agent-driven web navigation model

  • OpenWA

    Self-hosted WhatsApp API gateway with multi-session support and dashboard

Updated