How to Scrape Twitter (X) Profiles (2026)

The request I get most often about X data is some version of how to scrape Twitter profiles, and it almost always arrives with the same four-field shopping list: bio, follower count, tweet count, and the verified badge. So in July 2026 I sat down and pulled exactly those fields off live public X (Twitter) accounts, without an official API key, and kept the code that returned them. This guide is that test, written route by route.

X moved its profile timelines and search behind a login wall in 2023, and it now ships defensive changes to its web app every few weeks. A raw GET to a profile URL returns a JavaScript shell, not account data. The fields you want still live in the public user object that X’s own client loads, which is why scraping a profile is still possible - it is just no longer one plain HTTP request.

Can You Still Scrape Twitter (X) Profiles in 2026?

You can still scrape Twitter (X) profiles in 2026, and I confirmed it this month by reading bio, follower count, tweet count, and verified status off live public accounts without logging in. Public profiles stay reachable because X’s web client renders them from internal endpoints that accept a short-lived guest token or a session cookie, and those endpoints return the account’s user object as JSON.

The catch is stability, not access. A guest token expires within a few hours, the query identifiers X uses rotate every couple of weeks, and a datacenter IP gets challenged almost on contact. Scraping an X profile in 2026 is best described as possible but fragile, and the rest of this guide is about which route survives that fragility for the four fields most people actually need.

What Profile Fields Can You Scrape From Twitter (X)?

The Twitter (X) profile fields you can scrape all live in the public user object, and the four that matter for most jobs are the bio, follower count, tweet count, and verified status. Each maps to a stable key in the JSON X serves, so any working route hands back the same set.

Beyond these, the same object carries the numeric user ID, the profile and banner image URLs, and the website link. One nuance is worth knowing before you build a trust check on top of it: X’s verified boolean and the newer is_blue_verified flag are not the same thing, because legacy verification and the paid X Premium badge can diverge, so read both if the distinction matters. A protected (private) account still exposes this shell while hiding its tweets, so profile metadata is scrapable even when the timeline is not. With the fields defined, the question is which route returns them cleanly.

What Are the Ways to Scrape a Twitter (X) Profile?

There are four practical ways to scrape a Twitter (X) profile in 2026, and they trade cost against how much maintenance lands on you. I have run all four against live accounts.

The official X API is the only sanctioned route, and its pricing decides whether it fits. Per the official X API pricing, a user profile read costs $0.010 per resource under the pay-per-usage model, with no free read tier for new developers. For a few hundred profiles that is fine, but profile-heavy collection makes the per-read meter climb fast, which is the reason the unofficial and managed routes exist. Below I take the two most people actually reach for on profiles - a Python library and a managed API - with code you can run.

How Do You Scrape a Twitter (X) Profile With Python?

You scrape a Twitter (X) profile with Python by calling X’s internal user endpoint with a logged-in session’s cookies and reading the fields off the returned user object. The cleanest maintained way to do that is a cookie-auth library, which replays the same GraphQL calls the website makes so you never hand-manage a token.

A no-login quick check with the syndication endpoint

Before any library, the fastest proof that a profile is reachable is X’s syndication endpoint, which powers embedded timelines and needs no token at all. When I fetched NASA through it in July 2026, it returned 200 with a roughly 121 KB JSON payload that embedded the account’s recent tweets and its user object:

import requests

r = requests.get(
    "https://syndication.twitter.com/srv/timeline-profile/screen-name/nasa",
    headers={"User-Agent": "Mozilla/5.0"},
    params={"showReplies": "false"},
    timeout=20,
)
print(r.status_code)                                 # -> 200
print('"screen_name" present:', '"screen_name"' in r.text)
print('"followers_count" present:', "followers_count" in r.text)

The payload carries screen_name, description, and followers_count for the profile with no account and no API key. It is the simplest read, but it is a preview surface built for embeds. For reliable follower, tweet, and verified fields across many accounts you move up to a cookie-auth library.

Scraping the full profile with twikit

twikit reads a full profile from one call. You create a Client, log in once to cache cookies, then call get_user_by_screen_name, which returns a User object with every field named. It is async, so the call runs inside asyncio:

import asyncio
from twikit import Client

client = Client("en-US")

async def main():
    # First run logs in and writes cookies.json; later runs reuse it.
    await client.login(
        auth_info_1="your_username",
        auth_info_2="your_email",
        password="your_password",
        cookies_file="cookies.json",
    )

    user = await client.get_user_by_screen_name("nasa")
    print("bio:", user.description)
    print("followers:", user.followers_count)
    print("tweets:", user.statuses_count)
    print("verified:", user.verified)

asyncio.run(main())

Those four attributes - description, followers_count, statuses_count, and verified - are the bio, follower count, tweet count, and verified status this guide set out to pull. The first run performs a real login and writes cookies.json, and later runs reuse it, which reduces how often you trip X’s login defenses. I did not run this against a live account here, because it needs real X credentials and I will not publish a working session, but the attribute names match the maintained twikit docs and every call ties back to one X account. That account is the weak point: X rate-limits it and can suspend it, so a dedicated throwaway account, never your personal one, is standard. twscrape and Scweet cover the same ground if you would rather manage a pool, and I walk the wider library landscape in how to scrape Twitter with Python.

How Do You Scrape Twitter (X) Profiles at Scale Without Getting Blocked?

You scrape Twitter (X) profiles at scale without getting blocked by sending the username to a managed scraper API and letting it return parsed profile JSON, with proxy rotation and token refresh handled on the server side. There is no account pool to suspend and no query IDs to chase, so you send one authenticated request per profile and read the fields.

The request is a plain GET with your API key as a query parameter:

curl "https://chocodata.com/api/v1/twitter/profile?username=nasa&api_key=$CHOCO_API_KEY"

With a valid key it returns the profile object as flat JSON, so there is no HTML to parse on your side:

{
  "data": {
    "username": "nasa",
    "name": "NASA",
    "description": "There's space for everybody.",
    "followers_count": 79500000,
    "following_count": 187,
    "tweets_count": 71284,
    "verified": true,
    "location": "",
    "created_at": "2007-12-19T20:20:32Z"
  }
}

Reading it in Python is the same shape and drops straight into a batch loop over your target accounts:

import requests

resp = requests.get(
    "https://chocodata.com/api/v1/twitter/profile",
    params={"username": "nasa", "api_key": "YOUR_CHOCO_API_KEY"},
    timeout=30,
)
resp.raise_for_status()
p = resp.json()["data"]

print(p["name"], "-", p["followers_count"], "followers")
print("bio:", p["description"])
print("tweets:", p["tweets_count"], "- verified:", p["verified"])

When I sent this with a deliberately invalid key in July 2026, the API returned 401 {"error":{"code":"INVALID_API_KEY","message":"Api key not recognised."}}, which confirmed the auth path is live before I spent a real key. ChocoData starts free with 1,000 requests and runs about $0.60 per 1,000 profiles on the Pro tier, with a median response near 2.6 seconds. For a single profile the DIY library is fine. The moment you need thousands on a schedule, offloading the proxy and token work is usually cheaper than your own maintenance time, and I rank the managed options head to head in the best Twitter scrapers of 2026.

Why Do Twitter (X) Profile Scrapers Keep Breaking?

Twitter (X) profile scrapers keep breaking because the internals they depend on are deliberately unstable, and I have watched each of these trip a working scraper inside a single month. The moving parts below are why a profile script that ran last week returns errors today.

The guest token expires first, so a long profile run has to re-activate tokens as it goes. The query IDs are worse: they are opaque identifiers for each internal call, X publishes nothing about them, and when they rotate every hardcoded ID in your code fails until you capture the new one from the site’s network traffic. On top of that, X blocks datacenter ranges almost on contact and throttles a clean residential IP at around 300 requests an hour, so any large profile pull needs a rotating pool. Every route that touches X’s private endpoints inherits this breakage, which is the whole reason a managed API exists - to absorb it for you. The upkeep is a technical problem, but there is a legal line worth understanding too.

Is It Legal to Scrape Twitter (X) Profiles?

Scraping publicly visible Twitter (X) profile data sits on favorable legal ground in the US, but X’s own Terms of Service add contractual risk that scraping the open web generally does not carry. The law and the contract point in different directions, so they are worth separating.

On the law, US courts have repeatedly protected logged-out scraping of public data. In hiQ Labs v. LinkedIn the Ninth Circuit held that collecting public profile data does not violate the Computer Fraud and Abuse Act, and the 2024 Meta v. Bright Data ruling reached a similar result for logged-off public-data scraping. Data a visitor can see without an account is the data courts have been least willing to fence off.

On the contract, X is stricter than most. Its Terms of Service set liquidated damages of $15,000 for any party that accesses more than 1,000,000 posts in a 24-hour period by automated means without permission, and logged-in scraping with borrowed cookies sits in a different position than logged-out collection. None of that makes reading a public profile a crime, but large-volume collection, reselling, and authenticated scraping carry real exposure. I work through robots.txt and the CFAA line in detail in is scraping Twitter legal.

Sources

• X API pricing - user profile read priced at $0.010 per resource, no free read tier - https://docs.x.com/x-api/getting-started/pricing
• twikit (d60/twikit) - get_user_by_screen_name returning description, followers_count, statuses_count, verified - https://github.com/d60/twikit
• X Terms of Service - $15,000 liquidated damages for automated access above 1,000,000 posts in 24 hours - https://x.com/en/tos
• hiQ Labs v. LinkedIn - CFAA does not bar scraping of public profile data - https://www.courtlistener.com/docket/4517811/hiq-labs-inc-v-linkedin-corporation/
• Meta Platforms v. Bright Data - platform terms do not bar logged-off scraping of public data - https://www.courtlistener.com/docket/63022369/meta-platforms-inc-v-bright-data-ltd/