How to scrape X with Python in 2026 (what still works)

#Quick answer

In 2026, most tutorials for building a Twitter scraper in Python point at dead tools. snscrape, Twint, and Nitter stopped working when X (formerly Twitter) killed anonymous guest access in 2023. What still works is account-based: libraries like twikit and twscrape drive X's internal GraphQL endpoints using a logged-in session, not an API key. They need real credentials and residential proxies, and they break every few weeks. The sanctioned alternative is the official API through tweepy, which is now pay-per-use.

Last updated: August 2026

#TL;DR

If you searched "twitter scraper python" and landed on a 2022 guide promising pip install snscrape and free anonymous tweets, that guide is out of date. X spent 2023 to 2026 closing the exact holes those tools used. Today you have three honest options: a free account-based scraper that you babysit (twikit, twscrape, Tweety, Scweet), the paid official API through tweepy, or a managed scraping service that eats the maintenance for you. Below is which is which, a minimal working twikit example, what every route now requires, and a straight answer on the legal and account-safety risk - because with a logged-in scraper, the account you risk is your own.

#What broke: the free-scraper graveyard

For years the standard answer was snscrape or Twint. Both are effectively dead for new work, and it helps to know why so you do not waste an afternoon on them.

• snscrape relied on anonymous guest access and public HTML endpoints. X removed guest access in 2023 and progressively shut those endpoints down, and the project paused active development the same year. It no longer returns reliable data.
• Twint was abandoned years ago and stopped working once X retired the endpoints it scraped.
• Nitter, the open-source front end many scrapers piggybacked on, saw its public instances collapse after X blocked the guest accounts they ran on.

The common thread: all three assumed you could read X without logging in. That assumption is gone. Any 2026 approach has to authenticate.

#What actually works in Python in 2026

Working tools fall into two camps. Account-based scrapers hit X's internal GraphQL API using your logged-in session. The official client uses the sanctioned, paid API. Here is the honest comparison:

| Tool | Type | API key? | Cost | Reality check | |---|---|---|---|---| | twikit | Account-based scraper | No | Free (open source) | Most actively maintained free option. Needs login or saved cookies. Breaks periodically. | | twscrape | Account-based scraper | No | Free (open source) | Rides internal GraphQL. Rotates multiple accounts. Same breakage cycle. | | Tweety / Scweet | Account-based scraper | No | Free (open source) | Work via a logged-in account. Smaller communities, slower fixes. | | tweepy | Official API client | Yes | Pay-per-use | Sanctioned and stable, but you pay per call and the free tier is gone. | | Managed API (third-party) | Hosted scraper | Their key | Per-call fee | Outsources proxy and token maintenance. Costs money, less control. |

Per its own repository, twikit is MIT-licensed, "uses scraping and does not require an API key," and authenticates with a username and password or a saved cookies.json. That single design choice - real account, no key - is what makes it work in 2026 and also what makes it risky, which we get to below.

#A minimal twikit example

Here is the shape of a working twikit script. It logs in once, caches the session to a cookie file, and pulls recent posts for a search term:

import asyncio
from twikit import Client

client = Client("en-US")

async def main():
    # First run authenticates; later runs reuse cookies.json
    await client.login(
        auth_info_1="your_username",
        password="your_password",
        cookies_file="cookies.json",
    )
    tweets = await client.search_tweet("x automation", "Latest")
    for t in tweets:
        print(t.user.name, "-", t.text[:80])

asyncio.run(main())

Two things to notice. You are logging in with a real account, so this is not anonymous data collection - it is your account doing the reading. And there is no pip install-and-forget here: when X rotates its GraphQL identifiers, calls start failing until you upgrade the library. Scrapfly, which maintains its own X scraper, reports that these defenses shift every two to four weeks, so budget maintenance time, not just build time.

#What every scraper now needs

Whichever account-based library you pick, two requirements are non-negotiable in 2026.

A logged-in account. Since guest access ended, X returns almost nothing to an unauthenticated request. twikit and twscrape both need valid credentials or exported cookies. That means every scrape is attributable to an account, and aggressive scraping can get that account rate-limited or suspended.

Residential proxies. Datacenter IP ranges get blocked within a request or two. Sustained scraping needs residential or mobile IPs that look like ordinary users, and you pace requests to avoid tripping anti-bot checks. This is the hidden cost most "free scraper" tutorials skip: the library is free, but the infrastructure to run it at any scale is not.

If you are only pulling a handful of your own posts occasionally, a single account with light pacing can be enough. If you want continuous, high-volume collection, you are effectively running a small proxy operation, and a paid API often works out cheaper once you count your own time. For a broader look at the tooling landscape, our roundup of X scraping tools and what actually holds up in testing compares the managed options, and the primer on what an X scraper is and how it works covers the concepts.

#Is scraping X with Python legal?

Here is the straight version. Scraping public data is generally treated as a gray area rather than clearly illegal, and courts have often sided with scrapers of genuinely public information. But two real risks apply, and neither is theoretical.

First, it can breach X's terms. Automated data collection through a logged-in account runs against X's rules, and the penalty is usually to the account: rate limiting or suspension. Because account-based scraping puts your own credentials on the line, the thing you risk is not abstract - it is the login you use every day. Read X's automation rules directly before you build, and treat any 2026 guide that promises consequence-free scraping with suspicion.

Second, data-protection law applies to personal data at scale. Regimes like the EU's GDPR restrict harvesting and reusing personal information even when it is publicly visible. Collecting public post text for trend analysis is a different risk profile from building a profile database of individuals.

We will not tell you scraping is safe or that it complies with X's terms, because it is neither clearly safe nor clearly compliant. It is a calculated risk. The API route, by contrast, is sanctioned - you follow published rules and pay for access.

#When to skip scraping entirely

Before you build a scraper, ask what you actually need the data for. Two common goals have better answers than a fragile Python script.

If you need reliable, sanctioned data, use the official API through tweepy. The catch is money: the self-serve free tier ended on February 6, 2026, and new developers are on pay-per-use pricing, so reads and writes each carry a per-call charge. Our guide to getting an X API key walks the current console.x.com flow, and the best X API alternatives roundup weighs the paid third-party services if the official pricing is too steep.

If your real goal is growth, not data - posting, threading, replying, and tracking your own results - then a scraper is the wrong tool entirely. You do not need to extract other people's tweets to grow your account. A local automation tool like X-Autopilot acts through your own logged-in browser session on your own machine, so it never buys API credits and never runs a scraping pipeline against strangers' data. That browser route is still a gray area under X's automation rules, not a sanctioned one, and we will not pretend otherwise. What it offers over shared cloud scrapers is a smaller detection surface: your own residential IP and browser, with the session cookie staying on your Mac rather than sitting in a vendor's cloud. That is lower relative risk, not the removal of risk.

#The short version

Building an X scraper in Python in 2026 means accepting that the free anonymous era is over. snscrape, Twint, and Nitter are dead. What works - twikit, twscrape, Tweety, Scweet - needs a real logged-in account and residential proxies, breaks every few weeks, and puts your own account on the line. tweepy and the official API are the stable, sanctioned route, but you pay per call. Pick based on what you are really after: sanctioned data means the paid API, and if you only want to grow your own account, skip scraping and automate your own session instead.