curl --request POST \
--url https://api.omnixapi.com/api/v1/twitter/webhooks \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"url": "https://your-app.com/hook",
"auth_token": "YOUR_X_AUTH_TOKEN",
"encryption_code": "YOUR_XCHAT_PIN",
"events": [
"message.received",
"tweet.mention",
"user.follow"
],
"secret": "my-shared-secret-1234567890",
"proxy": "http://user:pass@host:8080"
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
url: 'https://your-app.com/hook',
auth_token: 'YOUR_X_AUTH_TOKEN',
encryption_code: 'YOUR_XCHAT_PIN',
events: ['message.received', 'tweet.mention', 'user.follow'],
secret: 'my-shared-secret-1234567890',
proxy: 'http://user:pass@host:8080'
})
};
fetch('https://api.omnixapi.com/api/v1/twitter/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.omnixapi.com/api/v1/twitter/webhooks"
payload = {
"url": "https://your-app.com/hook",
"auth_token": "YOUR_X_AUTH_TOKEN",
"encryption_code": "YOUR_XCHAT_PIN",
"events": ["message.received", "tweet.mention", "user.follow"],
"secret": "my-shared-secret-1234567890",
"proxy": "http://user:pass@host:8080"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"status": true,
"data": {
"id": "<string>",
"url": "<string>",
"valid": true,
"created_at": "2023-11-07T05:31:56Z",
"secret": "<string>"
},
"error": null
}{
"status": false,
"data": null,
"error": "Missing required field: text"
}{
"status": false,
"data": null,
"error": "You can only delete your own tweets"
}Create Webhook
Register a webhook for an X account. url must be https (or http://localhost for testing). We run a CRC handshake on registration — the webhook is only valid:true once your endpoint answers it. The response returns a secret once (used for CRC and to verify delivery signatures) — store it. Supply encryption_code (your XChat PIN) for decrypted DM events.
curl --request POST \
--url https://api.omnixapi.com/api/v1/twitter/webhooks \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"url": "https://your-app.com/hook",
"auth_token": "YOUR_X_AUTH_TOKEN",
"encryption_code": "YOUR_XCHAT_PIN",
"events": [
"message.received",
"tweet.mention",
"user.follow"
],
"secret": "my-shared-secret-1234567890",
"proxy": "http://user:pass@host:8080"
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
url: 'https://your-app.com/hook',
auth_token: 'YOUR_X_AUTH_TOKEN',
encryption_code: 'YOUR_XCHAT_PIN',
events: ['message.received', 'tweet.mention', 'user.follow'],
secret: 'my-shared-secret-1234567890',
proxy: 'http://user:pass@host:8080'
})
};
fetch('https://api.omnixapi.com/api/v1/twitter/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.omnixapi.com/api/v1/twitter/webhooks"
payload = {
"url": "https://your-app.com/hook",
"auth_token": "YOUR_X_AUTH_TOKEN",
"encryption_code": "YOUR_XCHAT_PIN",
"events": ["message.received", "tweet.mention", "user.follow"],
"secret": "my-shared-secret-1234567890",
"proxy": "http://user:pass@host:8080"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"status": true,
"data": {
"id": "<string>",
"url": "<string>",
"valid": true,
"created_at": "2023-11-07T05:31:56Z",
"secret": "<string>"
},
"error": null
}{
"status": false,
"data": null,
"error": "Missing required field: text"
}{
"status": false,
"data": null,
"error": "You can only delete your own tweets"
}Authorizations
Your OmniX API key, e.g. omnix_live_.... Billed per call.
Body
Your https receiver URL (http://localhost allowed for testing). Max 200 chars.
"https://your-app.com/hook"
The X account auth_token cookie the action runs as.
"YOUR_X_AUTH_TOKEN"
Your XChat encryption code — the PIN you set when enabling encrypted chats on X. Used to recover your key so messages can be decrypted and outgoing events signed.
"YOUR_XCHAT_PIN"
Optional event-type allowlist. Omit to receive all types.
message.received, message.sent, message.edited, message.deleted, message.reactionAdded, message.reactionRemoved, tweet.mention, tweet.reply, tweet.quote, tweet.like, tweet.retweet, user.follow [ "message.received", "tweet.mention", "user.follow" ]
Optional pre-shared HMAC secret (16–128 chars). If omitted, one is generated and returned once.
"my-shared-secret-1234567890"
Optional outbound proxy for this call (http:// or https://, optionally user:pass@host:port). The X request runs through it — useful for geo-routing or spreading calls across IPs. SOCKS proxies are not supported.
"http://user:pass@host:8080"