X API v2 adds email retrieval with OAuth 2.0, plus profile banner and connection status fields

What this means for you

When you sign in to an app with your X account, the app can now ask for your email address, but only if you agree on the X permission screen. Apps can also show your profile picture and banner, and see whether you follow, block or mute an account. Check the permission screen if you'd rather not share your email.

The details

• Email (April 3, 2025): email address retrieval works with OAuth 2.0 in API v2. The OAuth 2.0 scopes table lists users.email ("Email from an authenticated user"), and the data dictionary lists confirmed_email as a user field holding "the confirmed email of the authenticated user".
• Profile images (June 17, 2024): X added the ability to get the profile image and cover picture URL through API v2. The data dictionary documents profile_image_url and profile_banner_url as user fields.
• Relationship (January 16, 2024): connection_status is an array describing the relation between the authenticating user and the user looked up, such as following, followed, follow request sent, follow request received, blocking and muting.
• How to request: add the fields to user.fields. Email also needs the users.email scope granted during the OAuth 2.0 flow.

What to do next

• Business owners: Nothing.
• Marketers and agencies: Nothing.
• Developers: Ask for users.email only if you need the email, and use profile_banner_url and connection_status instead of scraping or extra lookups.