Free Twitter API alternative

What the X API costs in 2026

X launched pay-per-use pricing for its API on 6 February 2026, according to the X developer changelog. Under this model, you buy credits upfront and pay per request. Recently active users of the legacy free tier received a one-time $10 voucher, while Public Utility Apps keep free access. The changelog says X's Basic plan and X's Pro plan (fixed fees of $200 and $5,000 a month) remain available and that existing subscribers can opt in to pay-per-use; the pricing page itself lists only pay-per-use.

Rates from the X API pricing page are below. Owned reads cover your own posts, mentions, likes, bookmarks and followers.

At $0.005 per post, reading 1,000 posts costs $5 and reading 10,000 posts costs $50. Reading the same resource again within the same 24-hour UTC window is billed once. Pay-per-use is capped at 3 million post reads per monthly billing cycle, and above that you need X's Enterprise plan. X gives $20 in free credits after your first credit purchase, plus a match of your first auto-recharge up to $50, though these credits expire after 3 months.

Even if you pay for credits, you cannot call api.x.com/2/... directly from browser JavaScript. On 28 October 2026, the API answered 401 without a token, sent no Access-Control-Allow-Origin header, and its OPTIONS preflight answered 405.

The syndication endpoint behind embedded posts

If you want to show a post's text and like count in the browser without paying per request, you can use https://cdn.syndication.twimg.com/tweet-result?id=<post ID>&lang=en&token=<token>. This is the undocumented endpoint behind embedded posts, and it is also used by Vercel's open-source react-tweet library. X publishes no documentation, terms, or limits for it and can change or remove it without notice.

In a probe on 28 October 2026, fetching id=20 returned HTTP 200 with 920 bytes of JSON: text "just setting up my twttr", author jack (@jack), favorite_count 308,745, conversation_count 18,120, and created_at 21 March 2006. A post with a link preview card returned 5,020 bytes. The response includes these fields:

• __typename: "Tweet", or "TweetTombstone" for a withheld post
• text, created_at, favorite_count, conversation_count
• user.name, user.screen_name, user.is_blue_verified
• entities, photos, mediaDetails, video, card (the link preview), possibly_sensitive

The endpoint's Access-Control-Allow-Origin header is https://platform.twitter.com, so a fetch() from any other site fails with a CORS error. When we sent the same request through https://proxy.cors.dev/, it returned 200 with the caller's origin in Access-Control-Allow-Origin, and 40 requests in a row through the proxy all returned 200.

Fetch a public post from the browser

To call the syndication endpoint from the browser, pass the target URL after https://proxy.cors.dev/ (for example https://proxy.cors.dev/https://cdn.syndication.twimg.com/tweet-result?id=20&lang=en&token=a). The free tier requires no signup and no key.

1. Generate the token parameter

   The token parameter must be present in the query string, but it is not checked. Without it the endpoint returned {} (2 bytes), and any non-empty string returned the full post. react-tweet computes it from the post ID as ((Number(id) / 1e15) * Math.PI).toString(36) with zeros and dots removed, and the snippet below does the same.

2. Fetch through the proxy and check the status

   Unknown or deleted IDs returned 404 with a 3,656-byte HTML error page, not JSON, so check the status before calling res.json().

3. Check for withheld posts and decode HTML entities

   Return null if __typename is "TweetTombstone". The text field contains HTML entities such as < and &, so decode it before display.

const PROXY = 'https://proxy.cors.dev/';
const decode = (html) => new DOMParser().parseFromString(`<body>${html}`, 'text/html').body.textContent;
const syndicationToken = (id) => ((Number(id) / 1e15) * Math.PI).toString(36).replace(/(0+|\.)/g, '');

async function getPublicPost(id) {
  if (!/^\d{1,40}$/.test(id)) throw new Error('Post IDs are numeric strings');

  const url = `https://cdn.syndication.twimg.com/tweet-result?id=${id}&lang=en&token=${syndicationToken(id)}`;
  const res = await fetch(PROXY + url);
  if (res.status === 404) return null;
  if (!res.ok) throw new Error(`Syndication answered ${res.status}`);

  // Deleted or withheld posts come back as {} or a TweetTombstone
  const post = await res.json();
  if (post.__typename !== 'Tweet') return null;

  return {
    text: decode(post.text),
    author: `${post.user.name} (@${post.user.screen_name})`,
    created: new Date(post.created_at),
    likes: post.favorite_count,
    replies: post.conversation_count,
    photos: (post.photos ?? []).map((photo) => photo.url),
  };
}

console.log(await getPublicPost('20'));

The free cors.dev tier supports GET and HEAD only, and allows about 600 requests a minute per IP. Past that limit, it answers 429 with a Retry-After header, and there is no daily or monthly quota.

What the syndication endpoint cannot do

The tweet-result endpoint only fetches single public posts when you already know the post ID:

• One post per request, looked up by its numeric ID
• No search, no user timelines and no follower lists
• No posting, liking or other write actions
• No documentation, terms or published limits, so it can change or disappear without notice

Other free routes: oEmbed and timelines

Two other keyless routes exist: oEmbed and the profile timeline.

For oEmbed, calling https://publish.twitter.com/oembed?url=<post URL> answers 301 to publish.x.com/oembed. Both send CORS headers, so you can call it directly with no proxy needed (see our guide on oEmbed endpoints and CORS). In our test it returned 630 bytes of JSON with author_name, author_url, and an html blockquote that loads https://platform.x.com/widgets.js. It gives you embed HTML, not structured fields such as like counts.

For profile timelines, https://syndication.twitter.com/srv/timeline-profile/screen-name/<name> answered 429 "Rate limit exceeded" from our server and through cors.dev on 28 October 2026. From residential connections it returned a 143,636-byte HTML page with the newest 20 posts embedded as JSON in a __NEXT_DATA__ script, and no CORS header, so treat it as unusable from the browser. A second timeline URL, https://cdn.syndication.twimg.com/timeline/profile?screen_name=jack, returned 200 with an empty body.

Keep X API tokens on a server

If you need endpoints that only the paid X API provides, do not call api.x.com/2/... from the browser. The free cors.dev tier refuses Authorization headers with 400 header_not_allowed (read more on why the free proxy refuses Authorization).

cors.dev Pro forwards Authorization headers, but a bearer token in browser code is visible to anyone who opens your page. With pay-per-use pricing, anyone holding your token can spend your credits. Always call the X API from your own server.

Good questions.