# Accessing X Internal API via Session Tokens

> Tutorial explaining session token replay for internal X API access

A 12-part tutorial by Denislav Gavrilov demonstrating how web scrapers and automation bots interact with internal X endpoints. It covers extracting active session credentials from browser DevTools, replaying them in API requests, and managing session persistence with a local browser bridge.

## The framework

Key points:

- Two ways to bot: website API vs browser automation (selenium/puppeteer); API is faster and more flexible.
- Session persistence via cookies is the unfixable flaw: get auth\_token, csrf token, bearer token and replay them in a curl request; against Bearer-auth sites there is little they can do without a concentrated security effort.
- For X specifically: bearer + auth\_token + ct0 gives full free access to the official API.
- Exact request pattern: curl -s "https://x.com/i/api/2/timeline/conversation/${TID}.json?tweet\_mode=extended&count=40" -H "Authorization: Bearer $BEARER" -H "x-csrf-token: $CT0" -H "x-twitter-auth-type: OAuth2Session" -H "x-twitter-active-user: yes" -H "cookie: auth\_token=$AUTH\_TOKEN; ct0=$CT0" \| jq
- Token refresh problem handled by "browser bridging": a local Node bridge (bridge.js on localhost:3000) keeps the session live; built by reverse engineering (rev-eng folder, files legacy.json, twotab\_cli.py).
- Demonstrated builds: a browser extension and a terminal client for X.

## What it is for

- Study how session tokens and cookies are replayed for programmatic web access
- Compare the efficiency of direct API requests against browser automation tools
- Implement browser bridge mechanisms to maintain long-lived automation sessions

## Key points

- Comparison between browser automation (Puppeteer/Selenium) and direct API interactions
- Identification of key authentication values including auth\_token, ct0, and bearer tokens
- Header structure and endpoint mapping for internal timeline and conversation routes
- Implementation of a local Node.js bridge to manage session renewal
- Example implementations including a browser extension and a terminal-based client

## Pricing

Free

## Details

- Type: Framework
- Category: [Development](https://xiry.app/topics/development.md)
- Platforms: API, Command line, Browser extension
- For: Developers and security researchers studying web automation and API authentication patterns
- Alternative to: Official X API, Puppeteer, Playwright
- Tags: api, reverse engineering, authentication, web scraping, twitter, automation

## Why it was saved

- [@kuberdenis, 6 May 2025](https://x.com/kuberdenis/status/1919838504688689572): Explains the general session-hijacking exploit that unfixably enables bots, plus the exact request-header pattern for the X API V2 conversation endpoint.

## Compare

- [Alternatives to Puppeteer](https://xiry.app/alternatives/puppeteer.md)
- [Alternatives to Playwright](https://xiry.app/alternatives/playwright.md)

## Related

- [Parse](https://xiry.app/resources/parse): Turn any website into a structured REST API using natural language (Web app, Freemium)
- [Hyperbrowser](https://xiry.app/resources/hyperbrowser): Cloud browser infrastructure and automation agents designed for AI applications. (Web app, Freemium)
- [API Anything](https://xiry.app/resources/api-anything): Turn websites into plain HTTP APIs for AI agents to call directly. (GitHub repo, Open source)
- [Cloudflare /crawl Endpoint](https://xiry.app/resources/cloudflare-crawl-endpoint): Single API endpoint to crawl entire websites to Markdown, HTML, or JSON (Tip, Freemium)
- [Enabling FIRE-1 in the Firecrawl Scrape API](https://xiry.app/resources/enabling-fire-1-in-the-firecrawl-scrape-api): API configuration pattern for Firecrawl's agent-driven web navigation model (Tip, Freemium)
- [OpenWA](https://xiry.app/resources/openwa): Self-hosted WhatsApp API gateway with multi-session support and dashboard (GitHub repo, Open source)

Updated 11 October 2026. Page: https://xiry.app/resources/accessing-x-internal-api-via-session-tokens

Make your own library: Xiry takes your saved reels, tweets, Reddit bookmarks and Watch Later videos, makes them searchable and pulls the useful stuff out, like this library. It's invite-only for now; join the waitlist at https://xiry.app/#waitlist.