What's new

API contract changes

Threads profiles

Threads Profile API

GET /v1/threads/profile returns a public Threads account. Send a username with or without the @, the account's numeric id, or a threads.com or threads.net profile link, including the replies, reposts and media tabs.

Follower counts are the exact integer Threads publishes. The response also lists the topic labels Threads shows on the profile and which bio links Threads marks verified. A private account's public header comes back with is_private true. An unknown account is not_found, and a post link is refused.

API contract changes

Sign in with Google, GitHub or a password, and two-factor authentication

The dashboard has a new sign-in.

• Sign up and sign in with Google, GitHub, or an email address and a password (the address is verified first). The emailed sign-in links are gone: POST /v1/signup is removed, and POST /v1/session is now the dashboard's setup call once you are signed in.
• Two-factor authentication with an authenticator app and backup codes, for every way of signing in.
• Security settings: your sign-in methods, password, sessions (sign out any of them), and a log of sign-ins and security changes (GET /v1/security_events).
• AI agents still sign up with POST /v1/agent_signup. To activate an agent's live key, its human now signs in (or signs up) with the address the agent used and approves the agent.

Self-serve signup, test keys, API key management and usage

You can now get started without talking to anyone, test for free, and manage your account through the API.

• Sign up with your email address: the emailed link creates your account with free credits, a live key and a test key, and opens the dashboard (keys, usage, balance, credit packs). AI agents can sign up with POST /v1/agent_signup: they get a test key at once and a live key that works once you confirm by email.
• Test keys (st_test_…) answer every endpoint from recorded responses, free and deterministic, and reserved "magic" inputs trigger each error code, so integrations and CI can exercise every branch at no cost.
• API keys have scopes (endpoints, jobs, account:read, admin), optional spend limits per day or month (spend_limit_reached), expiry and IP allowlists, managed through /v1/api_keys.
• Account and usage: GET /v1/account (balance, plan, the calling key), GET /v1/usage (requests and credits over time by endpoint, key and outcome) and GET /v1/credit_transactions (the ledger). Set low_balance_threshold to get a credits.low email and event.
• meta.mode says whether a response came from a live or a test key. forbidden is now returned (with details.reason), and a missing key's unauthorized says where to get one.

Request conventions, richer errors and response metadata

Every endpoint now follows the same request conventions, and every response tells you more about itself.

• Unknown parameters are rejected with invalid_input, free, naming the parameter and the one you most likely meant (username → handle). Previously they were ignored. Common parameters (max_age, fields) are always known.
• Errors carry everything needed to react without parsing the message: status, retryable, param, remediation, doc_url, details (for example credits_required, or the endpoint a link belongs to) and charged (always false). retry-after is never sent on credit errors.
• A link of the wrong kind (a profile link sent to a video endpoint, a link from another platform) is answered with the endpoint that takes it.
• meta gains input (what your url resolved to), credits_remaining, client_request_id and warnings.
• fields selects only the fields you need, after the cache, at no cost.
• Lists gain page.end_reason and a Link: rel="next" header; since stops paging on newest-first lists.
• Headers: send x-client-request-id to have your own ID echoed and logged, and traceparent to match traces. RateLimit-Policy and RateLimit describe the account's runaway-protection ceiling, and Cache-Control: max-age works like max_age.
• Deprecated endpoints will announce themselves with Deprecation and Sunset headers and a warning, and answer endpoint_retired after their sunset. This changelog is also a JSON Feed.

Background jobs and batches, webhooks, events and Idempotency-Key

Run many requests, or one long one, without holding a connection open, and hear back when they are done.

• Jobs: POST /v1/jobs runs a batch of endpoint requests in the background, at each endpoint's own price, and max_pages walks a whole list server-side. With ?wait a short job answers inline (a synchronous batch); otherwise poll GET /v1/jobs/{id} (free), page through GET /v1/jobs/{id}/results as items finish, or download every result from the job's signed results_url. Prefer: respond-async turns any endpoint request into a one-request job.
• Credits are set aside per job (max_credits) and charged per item as it ends; failed items are free. A key's spend limit holds through its jobs, and a test key's jobs answer from recorded responses, free.
• Webhooks (Standard Webhooks signatures, retried for days, secrets rotated without downtime) deliver job.completed, job.canceled, job.expired, credits.low, credits.depleted and api_key.spend_limit_reached; /v1/events lists every event and redelivers one on request.
• Idempotency-Key on every POST: retrying with the same key and body never repeats the work.