File 06 · Account review
How to check and revoke connected apps and sessions on X
Your password isn't the only way into your account. Connected apps and logged-in sessions keep access until you remove them, and both lists take two minutes to review.
Two lists on X show who can get into your account right now without knowing your password. Connected apps are third-party services you once authorized. Sessions are the browsers and devices that are currently logged in. Attackers like both, because they survive a password change more often than people expect, and most owners never look at them.
Both lists live under Settings and privacy > Security and account access > Apps and sessions.
Connected apps
What you'll see
Each entry is a service you clicked Authorize for at some point: a scheduler, an analytics dashboard, a game, a "see who unfollowed you" tool, a website login that used X. Tap one to see what it's allowed to do and when you authorized it.
Permissions usually fall into a few groups:
| Permission | What it lets the app do | Risk if the app turns bad |
|---|---|---|
| Read | See your posts, profile, follows and lists | Low to moderate, privacy |
| Read and write | Post, reply, like, follow and delete as you | High: spam and scam posts from your account |
| Direct messages | Read and sometimes send your DMs | High: private conversations and DM phishing |
| Email address | See the email on your account | Moderate: targeted phishing |
What to revoke
Go through the list and revoke:
- Anything you don't recognize.
- Anything you haven't used in the last few months.
- Small toys and quizzes that have write or DM permissions. A personality test has no reason to post for you.
- Tools from companies that have shut down or been sold. Their access tokens may now belong to someone else.
- Duplicate entries for the same service, if you only use it once.
Revoking is instant and safe. If you remove a tool you actually use, you just authorize it again next time you sign in to it.
Before you authorize a new app
Read the permission screen that appears before you click Authorize. Check that the app's name and website match what you expected, and ask whether the permissions fit the job. A follower analytics tool needs read access. It does not need to send DMs. If an app asks you to type your X password into its own page instead of sending you to X's authorization screen, close it.
Signs an app is misusing its access
You may not notice a rogue app until your followers do. Typical signs: posts or replies you didn't write, often with links, appearing in bursts; follows of accounts you've never seen; likes on spam; DMs sent to your contacts that you never typed; or your profile picture and bio changing. X points out that a buggy third-party app can cause unexpected activity too, without anyone having your password.
Either way, the response is the same. Open Connected apps, revoke every app you don't fully trust, then delete the unwanted posts and unfollow the spam accounts. If the activity continues after the apps are gone, assume someone has a session or your password, and move on to the next section.
Sessions
What you'll see
Sessions lists every device and browser currently signed in to your account, with the device type, a rough location based on IP address and when it was last active. The session you're using now is marked as the current one.
What to look for
- Devices you don't own, such as a Windows PC when you only use a Mac and an iPhone.
- Browsers you don't use.
- Sessions active at times you weren't online.
- A long list of old sessions on phones you've sold or lost.
Locations are approximate. A mobile network or VPN can place you in a different city, so judge mainly by device and time.
Logging out
Tap a session to log it out, or use the option to log out of all other sessions. Logging out a session ends it on X's side, which is the fix for session cookie theft: the stolen cookie stops working. If you find a session that isn't yours:
- Log out all other sessions.
- Change your password to a new unique one.
- Check that two-factor is on and still uses your own method.
- Revoke connected apps you don't recognize.
- Scan the computer you use for X. Someone got a session without your login, and malware on your own machine is the usual cause.
Our first-hour guide has the full sequence.
Account access history and logged-in devices
Next to Sessions you'll find Account access history, which lists recent logins with the app and approximate location, and a list of logged-in devices and apps. They help you answer "when did this start?" Look for a login from an unfamiliar device shortly before odd activity began. That points to how the attacker got in.
Also check these while you're there
- Delegates. If you use X Delegate, open it under Security and account access and confirm every member still needs access. Team accounts should read securing a brand account.
- Email and phone. Under Your account > Account information, confirm the email address and phone number are yours.
- Browser extensions. Not an X setting, but extensions on the browser you use for X can read pages you visit. Remove ones you don't need.
A two-minute routine
Put a reminder in your calendar every three months: open Apps and sessions, revoke apps you don't use, log out sessions you don't recognize, and glance at access history. Business and high-profile accounts should do it monthly. Then run the security check to catch the settings these lists don't cover.
Questions
Does changing my password disconnect third-party apps?
Not necessarily. Apps you authorized hold their own access, so revoke them separately under Connected apps. Then review Sessions to make sure no unknown device is still signed in.
I don't recognize a location in my sessions. Was I hacked?
Not always. Locations come from IP addresses, and mobile networks and VPNs often show a city far from where you are. Look at the device type and time too. If the device isn't yours, log it out and change your password.
How often should I review these lists?
Every three months for a personal account, and every month for a business or high-profile account. Also check right away after clicking a suspicious link or seeing activity you didn't do.
TweetAttacks is independent and not affiliated with X Corp. Settings names can change when X updates its apps; if a menu has moved, search its name in X's settings.