Problem

The bookmarks endpoint (GET /2/users/:id/bookmarks) requires OAuth 2.0 Authorization Code Flow with PKCE. It explicitly rejects OAuth 1.0a:

{"title": "Unsupported Authentication", "detail": "Authenticating with OAuth 1.0a User Context is forbidden for this endpoint. Supported authentication types are [OAuth 2.0 User Context]."}

Requirements

1. Enable OAuth 2.0 in the X Developer Portal for the app
2. Get Client ID + Client Secret
3. Implement PKCE flow (tw auth oauth2) — opens browser, captures callback
4. Store refresh token in ~/.config/tw/oauth2_token.json
5. Auto-refresh access tokens (they expire in 2 hours)
6. Add tw bookmarks subcommand

Scopes needed

• bookmark.read
• bookmark.write (for tw bookmark add <id> / tw bookmark remove <id>)

References

• https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code