X login outage affected some third-party apps, issue now resolved

Starting around September 28 (JST), users encountered an issue that prevented them from logging in to or connecting some third-party apps with their X accounts. Live-streaming services including REALITY and TwitCasting appear to have experienced the issue.

A problem with X's OAuth system, which third-party services use to connect X accounts, most likely caused the failures. X fixed the OAuth issue shortly after 10 a.m. on October 1.

Some apps could not log users in with X accounts

On September 28 (JST), the official X account for the mobile live-streaming service REALITY reported that users could not log in to the service with their X accounts.

According to the post, users who had already logged in to REALITY with an X account would be unable to log back in with X after logging out. REALITY urged users to link another social media account before logging out.

Live-streaming service TwitCasting also reported that an issue on X's side prevented users from logging in to new sessions with X accounts through its app.

The official X account for Twilog, a service for archiving and searching X posts, reported the same issue. Several other services also appear to have experienced related problems.

The issue has been resolved

Starting shortly after noon on October 1 (JST), several affected services began reporting that users could once again log in with X accounts.

At the time of writing, REALITY and TwitCasting, mentioned above, had not announced whether they had recovered from the issue.

X's OAuth system likely caused the issue

Third-party services use a system called OAuth when they let users sign in with accounts from X and other social platforms.

My investigation found strong evidence that the services where X login stopped working had encountered a problem with X's OAuth system.

At 10:54 a.m. on September 28 (JST), a developer posted the first report in the X Developer Community that OAuth login redirects were not working correctly.

At 1:30 a.m. on September 29 (JST), Taylor Caldwell, who works on X's developer platform, said X had received numerous reports of mobile login failures involving X accounts. Developers then submitted several similar reports to the X Developer Community.

At 1:28 a.m. on September 30 (JST), Caldwell said the team was investigating a possible regression on the platform. At 10:30 a.m. on October 1 (JST), she said the team had fixed the OAuth issue.

About two hours later, several services that appear to have experienced the problem began announcing recoveries. The symptoms and timeline line up with X's OAuth incident, so I believe the series of failures that prevented users from logging in to third-party services with X accounts most likely stemmed from that OAuth issue.