X — still `twitter-oauth20` in the catalog and in the API hostnames — signs users in with their X account. It suits consumer and creator products where the handle is part of the user's identity in your product.

## Copy the redirect URI

In the [Authdog console](https://console.authdog.com), select the project and environment, open **Authentication > Providers**, find **Twitter (X)**, and click **Enable**. Copy the redirect URI shown in the form:

```url
https://identity.authdog.com/api/v1/callback/<connectionId>
```

## Create the X app

1. Open the [X Developer Portal](https://developer.x.com/en/portal/dashboard) and create a project and an app.
2. In the app's **Settings**, find **User authentication settings** and select **Set up**.
3. Enable **OAuth 2.0**.
4. Set the **Type of App** to **Web App, Automated App or Bot** — a confidential client, which is what issues a client secret.
5. Under **Callback URI / Redirect URL**, paste the redirect URI from Authdog.
6. Fill in the website URL, and the terms and privacy URLs if prompted.
7. Save, then copy the **Client ID** and **Client Secret** from the **Keys and tokens** tab.

> **Caution**
>
> Use the OAuth **2.0** Client ID and Client Secret. The API Key and API Secret on
> the same page belong to OAuth 1.0a and will not work with this connector.

## Configure Authdog

| Field | Value |
| --- | --- |
| **Client ID** | OAuth 2.0 Client ID |
| **Client Secret** | OAuth 2.0 Client Secret |

Save, then toggle the connection **active**.

## What X returns

Authdog requests `users.read tweet.read offline.access` and reads the profile from `https://api.twitter.com/2/users/me` — the numeric ID, name, and username.

X does not release email addresses through OAuth 2.0. Every user who arrives through this connector has no email on their identity, so treat it as a secondary sign-in method: pair it with a connector or method that does provide one, or collect an address after the first sign-in.

Handles change. Link on the numeric ID, which does not.

Access is also tier-dependent — the free tier's rate limits are low enough to matter on a busy sign-in page. Check your project's access level before launching.

## Test it

1. Open your environment's hosted sign-in page, or link to `https://identity.authdog.com/api/v1/signin/<connectionId>`.
2. Select the X button and authorize.
3. Confirm the user appears under **Users**, and that your application's post-sign-up path handles a user with no email.

## Troubleshooting

| Symptom | Cause |
| --- | --- |
| `Something went wrong` on the authorize screen | The callback URL does not match, or user authentication settings were never saved |
| `invalid_client` | OAuth 1.0a keys used instead of the OAuth 2.0 client credentials |
| `unauthorized_client` | The app type is set to a public client, which has no secret |
| Rate limit errors | The project's access tier is too low for your sign-in volume |

## Related

| Read | To learn how to |
| --- | --- |
| [Connectors](/docs/connectors) | Set up any other social provider |
| [Users](/docs/users) | Collect an email after a first sign-in |