Account Activity API v2 accepts OAuth 2.0 with fine-grained scopes

What this means for you

When you connect X to an app, the app gets a key that says what it may do. X has an older key type and a newer one. Its live-alerts service for accounts used to need the older one, which grants everything or nothing. Now it accepts the newer key, which can ask for just what it needs. You might see a narrower permission screen.

The details

• What changed: Account Activity API v2 subscriptions can be created with OAuth 2.0 user context and fine-grained scopes. The changelog's example scope is follow.read; the OAuth 2.0 scopes table lists it as follows.read.
• Precedence: existing OAuth 1.0a integrations "continue to work without disruption", and when present, OAuth 1.0a permissions fully override OAuth 2.0 scopes.
• App-level calls (listing and deleting subscriptions, subscription count) and the /2/webhooks management endpoints use an OAuth 2.0 App Only Bearer Token.
• Webhook signatures: the Webhooks introduction recommends verifying X-Twitter-Webhooks-Signature-OAuth2, computed with the app's OAuth 2.0 client secret. X-Twitter-Webhooks-Signature (OAuth 1.0 consumer secret) stays for backward compatibility.
• Doc mismatch: the Account Activity introduction's FAQ still says subscribing a user requires OAuth 1.0a.
• Deprecation: the same introduction says the Account Activity API "is being deprecated" in favour of the X Activity API, with no date given.

What to do next

• Business owners: Nothing.
• Marketers and agencies: Nothing.
• Developers: Use OAuth 2.0 tokens for new Account Activity subscriptions, verify the OAuth 2.0 signature header, and plan the move to the X Activity API.