X API adds OAuth 1.0a to OAuth 2.0 token exchange

What changed

On September 21, 2026 X documented a token exchange that converts a user's OAuth 1.0a access token and secret into an OAuth 2.0 access token and refresh token, with no consent screen or re-authorization. Granted scopes are derived from the permissions the user originally authorized, and offline.access is always included.

What it means

Apps with stored OAuth 1.0a user tokens can move users to OAuth 2.0 without asking them to reconnect.

Who is affected

Developers of scheduling tools that still hold OAuth 1.0a access tokens for connected X accounts.

What to do

Exchange each user's stored token and secret at POST /2/oauth2/token using the token-exchange grant type. The changelog states no deadline for retiring OAuth 1.0a.