Automation X in 2026: What's Left in the API After Cleanup

If your service or agency has automated work with X (formerly Twitter), the year 2026 has rewritten the rules twice. In February, the platform completely shut down the free API tier and transitioned new developers to a pay-per-use model. In April, the write endpoints for subscriptions, likes, and quoting disappeared from all self-serve tiers — now they exist only in Enterprise contracts, which start at around $42,000 per month. And in May, the platform reduced limits at the account level: an unverified profile now publishes 50 original posts per day instead of the previous 2400.

Next is an analysis of what is actually still available, how much it costs per operation, which limits you will hit first, and where proxies truly solve the problem, and where they do not move the ceiling even with a request.

What Exactly Was Removed and When

The timeline of changes looks like this:

• February 2026 — the free tier has been discontinued. The default model for new developers is pay-per-use, payment for actual operations.
• April 2026 — the follow, like, and quote-post endpoints were removed from all self-serve tiers. They were taken out of the free level even earlier, but now access to them is only through Enterprise.
• June 2026 — the legacy Basic tier at $200 per month is switched to a pay-per-use model; no new subscriptions for Basic and Pro are being opened, and old accounts are maintaining access.
• May 2026 — limits at the account level have been reduced, and they are common for the API, web, and mobile application.

The practical takeaway from the first block: any product built around automatic subscriptions, auto-liking, or quoting others' posts has lost its legal self-serve path. It hasn't just become more expensive — it has been lost. The difference is fundamental: price increases can be managed with a budget, while the absence of an endpoint cannot be remedied by anything other than an Enterprise contract.

What Remains on a Pay-Per-Use Basis

Self-serve today covers four groups of operations: posting, reading posts and feeds, replies within a limited window, and direct messages to those who have agreed to receive them. The costs per operation are as follows:

• $0.015 — standard text post.
• $0.20 — post containing a link. The difference is more than thirteen times, and this is the most underestimated item in budget calculations.
• $0.005 — reading one post, with a cap of 2 million reads per month.

Streaming and full-text archival search on a pay-per-use model are not available — this territory belongs to Pro (for those who still have it) and Enterprise. The legacy Basic tier provided around 50,000 records and 10-15 thousand reads per month with a seven-day search window; Pro for $5,000 offers about 300,000 records and a million reads with archiving and streaming.

Calculate your scenario in advance. A content agency posting 30 link-containing posts a day across 20 client accounts spends $120 daily just on posting — $3,600 monthly. The same volume without links in the body of the post costs $270 monthly. The structure of the publication here affects the bill more significantly than the choice of the tier.

Two Different Limits: Application Limit and Account Limit

This is where most often mistakes are made. In X, there are two independent ceilings, and they are calculated based on different entities.

The first — application and token limits. These are the classic rate limits of endpoints in sliding windows:

• searching for recent posts — 300 requests per user every 15 minutes and 450 per application;
• creating posts — 100 per user every 15 minutes and 10,000 per application per day;
• reading the feed — 900 per user every 15 minutes;
• deleting posts — 50 per user every 15 minutes;
• direct messages — up to 1,440 per day per account.

The window starts with the first request, not at the round hour mark. When exceeded, an HTTP 429 error with code 88 is returned, and the x-rate-limit-reset header contains the Unix timestamp of the reset moment. This is the only honest signal indicating when you can retry the request: blind retries with a fixed pause simply burn the quota and prolong the block.

The second — account limits. Since May 2026, an unverified profile is limited to about 50 original posts, 200 replies, 400 follows, and 500 direct messages per day. The key point: this counter is shared. It doesn't matter whether the action came from the official API, the web interface, or the mobile application — it all goes into the same basket.

From this follows something that the proxy industry does not emphasize loudly enough: changing the IP does not move any of these ceilings. Endpoint limits are tied to the application token and user context, while action limits are tied to the account itself. Rotating addresses will not add a single post per day. The same conclusion was discussed in the context of Reddit API limits and the role of proxies in 2026: proxies are responsible for availability and geography, not quotas.

Where Proxies Are Truly Needed

This does not mean that proxies are unnecessary when working with X. Their task is simply different, and it can be formulated precisely:

1. Geographical availability and regional delivery. Trends, local feeds, access to the platform from countries where it is restricted. Here, a real IP from the required region is important — residential proxies provide an address from a regular home provider, which does not differ from the traffic of a real user by ASN.
2. Isolation of infrastructure. An agency managing accounts for different clients should not mix their sessions in one network context. If one client is restricted, the others should not feel it. The rule is simple, and we have discussed it in detail in the material about the principle of "one proxy — one account".
3. Stability of the channel. Long tasks for reading feeds are more often hindered by network interruptions than by limits. A dedicated channel with predictable latency means fewer retries and less burned quota.
4. Working with mobile scenarios. If the process is tied to the behavior of a mobile client, an address from a mobile operator looks more natural to the platform than a data center address. For such tasks, mobile proxies are used.

The honest formulation is as follows: proxies address the question of "where and how reliably you are coming from," but not the question of "how many actions you are allowed." A seller who promises otherwise is selling you an expectation that will not materialize.

What Not to Do

After the changes in April, some teams are considering browser automation as a replacement for the closed endpoints. It is important to understand the cost of this solution.

The rules of X explicitly require that all automation be conducted through the official API: scraping the interface, browser automation, and unofficial APIs are prohibited by the terms of use. The platform has been litigating against scraping since 2023, and in March 2026, there was a massive wave of bans for "inauthentic behavior." Practitioners estimate that an account used for automatic data collection lasts from three to fourteen days before being blocked — and no amount of address rotation fundamentally increases this duration, as the decision is made based on behavioral and fingerprint signals, not just on IP.

Separately: the trend in recent months is that platforms are increasingly moving from technical blocks to legal ones. In the summer of 2026, X demanded the closure of public frontends like Nitter; we discussed this in the material about how platforms changed their weapons against parsing. Infrastructure ingenuity is no longer the main risk factor — it has become a letter from lawyers.

How to Restructure Work: Practical Steps

1. Separate operations into remaining and lost. Posting, reading, replies, and DMs — remain. Subscriptions, likes, quoting — have gone to Enterprise. Everything built on the second group requires not optimization, but a change in the product model.
2. Recalculate the budget by operations, not by tier. Count posts with links separately: at $0.20 each, moving the link to the first reply instead of the body of the post changes the monthly bill dramatically.
3. Set your own rate limiter. A token bucket on your side, configured slightly below the official limits, is cheaper than catching 429s and dealing with the consequences. Regulate the outgoing flow in advance, rather than stopping after a rejection.
4. Handle 429s by header, not by timer. Read x-rate-limit-reset and wait exactly until the specified moment.
5. Isolate clients in different network contexts. A separate proxy and a separate set of credentials for each account is basic hygiene that limits the radius of impact in case of any restrictions.
6. Monitor account-level limits separately from API limits. They are counted together with manual actions of the SMM specialist. If a person publishes posts manually from the application, your scheduler will receive less than expected.

Conclusion

The year 2026 transformed X from a platform with a cheap API into a platform with pay-per-use pricing and strict separation: mass engagement actions are only available to corporate contracts, everything else is paid and within narrow limits. For most teams, the correct reaction is not to seek workarounds but to restructure processes around the remaining set of operations, calculate costs by operations, and proactively limit their own traffic.

Proxies in this scheme remain a necessary but clearly defined tool: they provide geography, channel reliability, and isolation of client accounts from each other. If you need exactly this effect — residential addresses from ProxyCove with pay-per-traffic close the task without subscription fees for idle ports. If, however, you are promised a way to bypass quotas — it’s better to read the section about the two ceilings again.