Alwasy met "Could not authenticate you"

[helvenk]

All of my twitter accounts login with username and 2fa met this error:

Response status: 401 | headers: "access-control-allow-credentials: true\naccess-control-allow-origin: https://x.com\naccess-control-expose-headers: Backoff-Policy,Content-Length,X-TD-Mtime,X-Acted-As-User-Id,X-Rate-Limit-Limit,X-Rate-Limit-Remaining,X-Rate-Limit-Reset,X-Response-Time,X-Transaction-Id,X-Twitter-Client,X-Twitter-Client-Version,X-Twitter-Diffy-Request-Key,X-Twitter-Polling,X-Twitter-Spotify-Access-Token,X-Twitter-UTCOffset\ncache-control: no-cache, no-store, max-age=0\ncf-cache-status: DYNAMIC\ncf-ray: 9a4029e69e7a17e6-SJC\ncontent-type: application/json;charset=utf-8\ndate: Tue, 25 Nov 2025 09:36:47 GMT\norigin-cf-ray: 9a4029e69e7a17e6-SJC\nperf: 7402827104\nserver: cloudflare envoy\nstrict-transport-security: max-age=631138519; includeSubdomains\nvary: accept-encoding\nx-response-time: 6\nx-served-by: t4_p\nx-transaction-id: 8e90b9ce820a7df0\nset-cookie: __cf_bm=LlAHaF1HU4QFQnixzfGzjuUjdy5U5LLl7F0.TD5wtQI-1764063407.140825-1.0.1.1-GBoX2iJAkxMYcqTxB9roqSd8dEip4beSiZOIvP3ZjQVT_It39bNPTfnEiOHuZUkdgah2QJqheLqTaRaFPmvtDl9LknsZtwO7VUpBC8u6YAK89Z0.3_LTUp4__onJNTtq; HttpOnly; Secure; Path=/; Domain=x.com; Expires=Tue, 25 Nov 2025 10:06:47 GMT" | data: {"errors":[{"message":"Could not authenticate you","code":32}]}

[helvenk]

Plain text:

Response status: 401 | headers: "access-control-allow-credentials: true\naccess-control-allow-origin: https://x.com\naccess-control-expose-headers: Backoff-Policy,Content-Length,X-TD-Mtime,X-Acted-As-User-Id,X-Rate-Limit-Limit,X-Rate-Limit-Remaining,X-Rate-Limit-Reset,X-Response-Time,X-Transaction-Id,X-Twitter-Client,X-Twitter-Client-Version,X-Twitter-Diffy-Request-Key,X-Twitter-Polling,X-Twitter-Spotify-Access-Token,X-Twitter-UTCOffset\ncache-control: no-cache, no-store, max-age=0\ncf-cache-status: DYNAMIC\ncf-ray: 9a4029e69e7a17e6-SJC\ncontent-type: application/json;charset=utf-8\ndate: Tue, 25 Nov 2025 09:36:47 GMT\norigin-cf-ray: 9a4029e69e7a17e6-SJC\nperf: 7402827104\nserver: cloudflare envoy\nstrict-transport-security: max-age=631138519; includeSubdomains\nvary: accept-encoding\nx-response-time: 6\nx-served-by: t4_p\nx-transaction-id: 8e90b9ce820a7df0\nset-cookie: __cf_bm=LlAHaF1HU4QFQnixzfGzjuUjdy5U5LLl7F0.TD5wtQI-1764063407.140825-1.0.1.1-GBoX2iJAkxMYcqTxB9roqSd8dEip4beSiZOIvP3ZjQVT_It39bNPTfnEiOHuZUkdgah2QJqheLqTaRaFPmvtDl9LknsZtwO7VUpBC8u6YAK89Z0.3_LTUp4__onJNTtq; HttpOnly; Secure; Path=/; Domain=x.com; Expires=Tue, 25 Nov 2025 10:06:47 GMT" | data: {"errors":[{"message":"Could not authenticate you","code":32}]}

[Faareoh]

Hello!

I’m having the same issue here. I use cookies to log into my account, and since 5:30 AM UTC+1 I’ve been getting this error when using the isLoggedIn method. However, I’m still able to fetch tweets even though the error occurs.

[helvenk]

Hello!

I’m having the same issue here. I use cookies to log into my account, and since 5:30 AM UTC+1 I’ve been getting this error when using the isLoggedIn method. However, I’m still able to fetch tweets even though the error occurs.

Could you please share your workaround? I cannot skip the error

[andreasasprou]

I ran into this same issue and debugged it thoroughly. There are actually two separate issues causing 401 errors:

Issue 1: Login fails at LoginSuccessSubtask

Root cause:
Twitter’s API changed behavior. After completing 2FA (LoginTwoFactorAuthChallenge), the session is already established (ct0 cookie is set). The library then makes one more API call in handleSuccessSubtask with empty subtask_inputs, which Twitter now rejects with a 401.

Fix in src/auth-user.ts: Modify handleSuccessSubtask to skip the final API call:

private async handleSuccessSubtask(
  _subtaskId: string,
  prev: TwitterUserAuthFlowResponse,
  _credentials: TwitterUserAuthCredentials,
  _api: FlowSubtaskHandlerApi,
): Promise<FlowTokenResult> {
  // Session is already established - no additional API call needed
  return {
    status: 'success',
    response: {
      ...prev,
      subtasks: [], // Clear subtasks to exit the login loop
    },
  };
}

Issue 2: API calls fail after successful login (for example, fetchListTweets)

Even after fixing the login, you may still get 401 errors when calling methods like fetchListTweets() (e.g. this is my primary use case)

Root cause:
Several endpoints are missing bearerToken2 in their requestApi calls. Other endpoints like fetchTweets, getTweet, and getProfile already use bearerToken2, but fetchListTweets, fetchTweetsAndReplies, and fetchLikedTweets do not.

Fix in src/tweets.ts: Add bearerToken2 to these functions:

// In fetchListTweets:
const res = await requestApi<ListTimeline>(
  listTweetsRequest.toRequestUrl(),
  auth,
  'GET',
  undefined,
  undefined,
  bearerToken2,  // Add this
);

Apply the same pattern to fetchTweetsAndReplies and fetchLikedTweets.

⸻

I have a working fork with both fixes at:
https://github.com/andreasasprou/twitter-scraper

To use it, pin to a specific commit hash in your package.json (using #main may cause caching issues with package managers):

"@the-convocation/twitter-scraper": "github:andreasasprou/twitter-scraper#382893c"

Hope this helps!

[helvenk]

Thank you for your help. I tried it, but it seems to occur another error. login is now working properly and success, but then the isLoggedIn check does not pass always.

[karashiiro]

Thank you, verifying fixes and then looking into isLoggedIn

[karashiiro]

Took these and some other fixes in #176, let me know if v0.21.0 fixes these problems.

[helvenk]

Thank you for your efforts, the authorization issue seems to be resolved now. However, I am now encountering a 404 error (using searchTweets).

Response status: 404 | headers: "cache-control: no-cache, no-store, max-age=0\ncf-cache-status: DYNAMIC\ncf-ray: 9a47259e5f10a8ec-SIN\ncontent-length: 0\ndate: Wed, 26 Nov 2025 05:57:12 GMT\norigin-cf-ray: 9a47259e5f10a8ec-SEA\nperf: 7402827104\nserver: cloudflare envoy\nstrict-transport-security: max-age=631138519; includeSubdomains\nx-rate-limit-limit: 50\nx-rate-limit-remaining: 47\nx-rate-limit-reset: 1764136937\nx-response-time: 10\nx-served-by: t4_p\nx-transaction-id: 2c29995942d4477d\nset-cookie: ct0=45640e6f762fd21a04feb147f955f227d1b4a3bb13d1e4291929b5c0cc8810199677b8caa7afdffa5d85991b658e7941fe39efabecaad55bb111344c1c15cbb2a84d332d56972b97ffd9b63a515fdb8a; SameSite=Lax; Secure; Path=/; Domain=.x.com; Max-Age=157680000; Expires=Mon, 25 Nov 2030 05:57:12 GMT\nset-cookie: __cf_bm=Bf8GCWq1WYDCqWzJ1rsWH9oQIqiuqLKi3qyjw6gPK1Q-1764136632.0578177-1.0.1.1-MgdZ1PDyg82SSoz7JuVmqDMzXtuMsLcKKP0c.iP2Jw0EGqqfPPfa1GB.WeQ9ssYljkqQHy9zE2wkfY5JM.IDXLGlqFPIl4JyK0CpBlaNFIMQ6lV57G2EeMJUn8xRaoET; HttpOnly; Secure; Path=/; Domain=x.com; Expires=Wed, 26 Nov 2025 06:27:12 GMT" | data:

[helvenk]

Correction: Fixed the 404 error by enabling the experimental xClientTransactionId, now working properly. Thank you guys again!

I think this issue can be closed at any time now.

[Durss]

Thank you so much for that super fast fix 🙏🏻
And for that awesome lib generally speak ing <3 !