Skip to content

Configuring X

Last updated

To set up X (formerly Twitter) login, create an X app with OAuth 1.0a sign-in, then enter its API Key and Secret in TML Social.

X's API is paid. Before X login will work, you must buy credits in X's Developer Console, and X bills your account for the API calls each login makes. When your credits run out, X login stops working until you add more. Theme My Login can't remove this cost. See X API pricing.

Before You Start

X requires a verified phone number on your account to buy credits. Turning on email access also requires a privacy policy and terms of service, each at its own URL, so have those pages ready.

Create the App

Follow X's Getting Access guide to sign in to the Developer Console, accept the Developer Agreement and create an app.

X shows the app's API Key and API Key Secret only once, when you create the app. Copy them then. If you lose them, you have to regenerate them, which invalidates the old ones.

Set Up Sign In With X

In your app's settings, set up "User authentication settings":

  1. Choose OAuth 1.0a, with "Read" permissions.
  2. Turn on "Request email from users". Theme My Login needs every user's email address, and X login won't work without it.
  3. For the type of app, choose "Web App, Automated App or Bot".
  4. Under "Callback URI / Redirect URL", add your TML login page URL with the provider appended as a query argument. By default, this is https://yoursite.com/login/?provider=twitter. Note that the provider is "twitter", not "x". If you changed the login page slug, use yours instead of "login". If your site uses plain permalinks, it's https://yoursite.com/?action=login&provider=twitter. X requires an exact match, including the trailing slash, and HTTPS.
  5. Enter your site's URL as the website URL, add your terms of service and privacy policy URLs, and save.

On a multisite network, each site has its own login page, so add a callback URL for every site that shows the buttons. X allows up to 10 callback URLs per app.

Obtain API Key & Secret

Copy the API Key into the "Consumer Key" field and the API Key Secret into the "Consumer Secret" field under Theme My Login → Social. X also calls these the Consumer Key and Secret. Don't use the Bearer Token, the Access Token or the OAuth 2.0 Client ID and Secret. On a multisite network, the settings are in the Network Admin, and one X app serves every site on the network.

Click "X" to open its box if it's closed, check "Enable" and then click "Save Changes".

Login With X

You will now see "Continue with X" on your login form. The first time someone logs in, they're matched to an existing user with the same email address or, if registration is open, a new user is created for them.

If users see "An email address is required to log in to this site", check that "Request email from users" is on.