Repository navigation
Fix X OAuth login by moving endpoints to x.com - #1
Merged
Merged
Conversation
X migrated the consumer experience off twitter.com, so a logged-in user's session cookie now lives on x.com. Serving the authorization page from twitter.com/i/oauth2/authorize left it unable to see that session, trapping users in a "you need to be logged into X" loop before the flow ever returned to our callback. Move the authorize, token, and user-info endpoints to x.com / api.x.com. Verified the new hosts respond as expected (authorize 200; token returns invalid_request for a dummy code, confirming the prod credentials are still accepted). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Users are stuck in a "you need to be logged into X" loop when logging in with X in production. They never make it back to our callback (confirmed: live prod log tail captured nothing during a real login attempt).
Root cause
XApi20.javahardcoded the authorization endpoint tohttps://twitter.com/i/oauth2/authorize. X migrated the consumer experience offtwitter.com, so a logged-in user's session cookie now lives onx.com. Thetwitter.comauthorize page can't see that session, trapping the user before the OAuth flow returns to our callback. This is an external change on X's side, which matches "can't log in any longer".Fix
Move the OAuth endpoints to
x.com/api.x.com:twitter.com/i/oauth2/authorize->x.com/i/oauth2/authorizeapi.twitter.com/2/oauth2/token->api.x.com/2/oauth2/tokenapi.twitter.com/2/users/me->api.x.com/2/users/meVerification
dialtone-secretsare valid (token endpoint returnsinvalid_requestfor a dummy code, notunauthorized_client).Still pending: a real end-to-end login through the new
x.comflow once deployed, since an interactive authorize can't be completed headlessly.🤖 Generated with Claude Code