/wp-content/plugins/ directory and activate it.X retired the old v1.1 API that earlier versions of this plugin used. Version 2.0 uses the X API v2, which needs only a Bearer Token. The old API key, secret and access token fields are no longer used.
If you are logged in as an administrator, the widget also shows the reason (for example a bad token, or an API plan that does not allow reading posts). Failed requests are cached for 5 minutes.