  Twin-field quantum key distribution (TF-QKD), which is immune to all possible
detector side channel attacks, enables two remote legitimate users to perform
secure communications without quantum repeaters. With the help of a central
node, TF-QKD is expected to overcome the linear key-rate constraint using
current technologies. However, the security of the former TF-QKD protocols
relies on the hypothesis of infinite-key and stable sources. In this paper, we
present the finite-key analysis of a practical decoy-state twin-field quantum
key distribution with variant statistical fluctuation models. We examine the
composable security of the protocol with intensity fluctuations of unstable
sources employing Azuma's inequality. Our simulation results indicate that the
secret key rate is able to surpass the linear key-rate bound with limited
signal pulses and intensity fluctuations. In addition, the effect of intensity
fluctuations is extremely significant for small size of total signals.
