TweetStream uses API-key authentication for WebSocket and REST access, with account management handled inside the authenticated product.
Encrypted transport
WebSocket connections use TLS (wss://), and REST requests go to https://api.tweetstream.io over HTTPS.
API keys and rotation
Your API key is the credential for both the WebSocket stream and the REST endpoints. Create and regenerate it in the dashboard. Regenerating replaces the key, so the previous key stops authenticating new connections and requests.
- WebSocket auth via
tweetstream.auth.token.<API_KEY>subprotocol - REST auth via
Authorization: Bearer <API_KEY> - Keep keys server-side; never ship them in public front-end code
Read-only monitoring
TweetStream monitors public posts from the accounts you track. Account management only changes the watchlist in your TweetStream workspace.
Data retention
Account and configuration data are kept while your account is active. Billing, anti-abuse, and operational-log records may be kept longer where reasonably necessary or required by law. The privacy policy explains retention and your rights in full.
Report an issue or request a review
Email support@tweetstream.io to report a security issue or ask a security question. Teams evaluating Scale can send their review requirements through the contact page.