# Leaked X Bearer Token? Regenerate It and Check Usage > X (Twitter) bearer token exposed on GitHub? Regenerate it in the developer portal, update your apps and check API usage. Step-by-step guide. Source: https://leakwatch.net/secrets/x-twitter-bearer-token --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. X (Twitter) Bearer Token Messaging · Secret guide # Leaked X (Twitter) Bearer Token: what to do in the first hour High severityDetected onlyLast verified October 23, 2026 · 5 min read An X bearer token is an app-level credential for the X API. It is sent as a header on each request and identifies the developer app, not a person, so whoever holds it can call the endpoints that app is allowed to use. Depending on the access level of the project, that can mean reading public posts and profiles at volume, searching the archive, or, with write access, posting on behalf of the app’s own account. The token alone does not sign anyone in, but it spends your API quota, can burn through your rate limits and can read data you pay for. Regenerate the token first, then check what was done with it. [Check your GitHub account for leaked secrets — free](/) Provider Twitter Severity High Impact SaaS account access and billing Checked live by LeakWatch No ## What an X bearer token looks like A bearer token is a long string that begins with the letter `A` repeated, followed by a body of letters, digits and a few percent signs. Developer portal tokens are typically around one hundred characters in total: ```text AAAAAAAAAAAAAAAAAAAAAA…XXXX X bearer token (masked) ``` The fixed prefix is distinctive, but a hit is more reliable when it appears next to a name such as `X_BEARER_TOKEN`, `TWITTER_BEARER_TOKEN` or an `Authorization: Bearer` header in code that calls `api.x.com` or `api.twitter.com`. Keep in mind that a bearer token is not the same as the consumer key, the consumer secret or an access token for a user account. Those belong to the same app but are separate values, and a file that leaked one often holds the others. ## How X bearer tokens get leaked - **Scripts and bots.** A scraper, a monitoring job or a posting bot with the token set as a constant so it runs without a secret store. - **Environment files.** A `.env` file that lists the bearer token with the consumer key and secret, pushed to a public repository. - **Notebooks and examples.** A data notebook or a tutorial in which the API call was run with a real token and the output was saved. - **Logs and error reports.** A debug log that prints the request headers, or a stack trace that includes the configuration object. - **Shared snippets.** A code sample pasted into a forum post or an issue to ask why a request fails. ## What to do in the first hour 1. **Find the app.** In the X developer portal, open the project and app that the token belongs to. If the token came from a file, match the app by the name in the file or by the project it was created under. 2. **Deploy a replacement first.** Regenerate the bearer token in the developer portal, store the new value in your secret manager or environment settings, and confirm your integration still returns data. 3. **Regenerate the exposed token.** Regenerating invalidates the old value, so requests made with it fail from then on. Do this before you clean the repository. 4. **Review the usage.** In the portal, look at the usage figures for the period since the exposure and compare them with your normal volume. Look for a jump in requests, endpoints your app never calls and requests from unfamiliar sources if your logs show them. 5. **Check what the app can do.** Review the access level of the project and the permissions of the app. If it has write access and you do not need it, lower it. Check whether the app’s own account posted anything you did not write. 6. **Rotate the other credentials.** If the same file held the consumer key, the consumer secret or a user access token, regenerate those too. A bearer token does not replace them. 7. **Clean the repository.** Remove the value from the working tree and rewrite history if the repository is public. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github). Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at X Open the X developer portal, go to the project and app that the token belongs to, and open the keys and tokens section. Find the bearer token and choose to regenerate it. Regeneration replaces the value, so every system that used the old one must be updated before it stops working. If you cannot find the app, check the other projects in the same developer account, since a token can belong to a project that is no longer in use. Menu names in the developer portal change from time to time. If the page you see differs from this description, follow X’s current developer documentation for regenerating app credentials. ## How LeakWatch detects it The rule is called “X (Twitter) Bearer Token”. It is a case-insensitive match that needs the words `x bearer`, `x_bearer` or `x-bearer` on the same line, optionally followed by a short run of other words, then an assignment sign or a colon, optional quotes or whitespace, and a value that starts with 22 capital letters `A` followed by 80 to 100 letters, digits or percent signs. The context words make the rule narrow, so a bare `AAAA…` string on its own is not reported. The severity is **high**. **This type is not checked live**: LeakWatch does not call the X API with the value it found, so a hit tells you the value has the expected format and context, not that it still works. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Can someone post as my app with this token? Only if the app has write access and the token can use those endpoints. Read-only tokens cannot post, but they can still read at the volume your plan allows. Check the access level and the app’s own account either way. Does regenerating the token also revoke the consumer key? No. The bearer token and the consumer key are separate values. If either one leaked, rotate the one that leaked. If the file held both, rotate both. Will my scheduled jobs fail after I regenerate? Yes, until you deploy the new value. Update the secret store first, then regenerate, and expect one short failed run if the timing was tight. ## Related - [Slack Webhook URL](/secrets/slack-webhook-url) - [Discord Bot Token](/secrets/discord-bot-token) - [Telegram Bot Token](/secrets/telegram-bot-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Twitter. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)