 |
| OAuth logo |
First lets get an oauth_access_token. For OAuth 2 the oauth_access_tokens are short lived and will usually only be valid for a couple of hours. Visit http://abrah.am (or any other @Anywhere enabled site) click on the "Follow @abraham on Twitter" button. This will create a popup where you will log into twitter.com and connect with the @Anywhere application.
 |
| @Anywhere authentication window |
The @Anywhere application is now authorized to act on behalf of your Twitter application and there is an oauth_access_token in your browsers localStorage as twttr_anywhere. You can use the following JavaScript command to retrieve your oauth_access_token. It works in Google Chrome's built in console, Firebug's console in Firefox and I'm sure other browsers as well.
*Note that the oauth_access_token can be used by itself to act as your Twitter credentials so don't go slinging it around the internet.
Now you have the oauth_access_token what to do with it? Make HTTP request to api.twitter.com over SSL.
What about POSTs? Yep those work too.
Now lets have a look at a method of getting the oauth_access_token that is similar the standard OAuth flow. Redirect a user to https://oauth.twitter.com/2/authorize with three paramaters:
- oauth_callback_url=http://abrah.am/ - The domain and subdomain must be registered with the Twitter
- oauth_mode=flow_web_client - Twitter should observe a browser redirect flow
- oauth_client_identifier=9QR94sYuXI3j6XkYrr1Ybw - The application's @Anywhere API key
Once the user connects their account with they application they are returned to the oauth_callback_url with an oauth_access_token in the url fragment.
The fragment also contains an oauth_bridge_code which can be used to exchange the temporary 2.0 oauth_access_token for a long lasting 1.0 oauth_token. Subscribe to the RSS feed to get notified when that post is published.
Update: Checkout the post on using Twitter Anywhere bridge codes.
Keep in mind that:
- OAuth 2 access tokens are short lived
- OAuth 2 access tokens are all that is needed to read and write your accounts Twitter data
- Anywhere was launched several months ago and the OAuth 2 spec has evolved a lot since then
- This is an internal authentication method and likely to change in the future
Let me know what you think of OAuth 2 in the comments.
I don't get it? So you're saying if you authorize an app to work on behalf of your twitter account it can do stuff on behalf of your twitter account? Or am I missing something?
ReplyDelete@JacoPretorius: don't understand what you are asking but yes generally when you authorize an application that application can do stuff on behalf of your Twitter account.
ReplyDeleteThis is a very helpful write-up. Thanks.
ReplyDeleteRight now, I'm trying to figure out how to retrieve the URL fragment (stuff after the #) in PHP. Seems the query query string doesn't provide access to anything after a pound sign.
@dharmesh: The majority of servers don't provide access to the fragment so you will have to use JavaScript to save it to a cookie or send it back to server.
ReplyDelete@abraham: Regarding the location hash -- I believe this is not a server issue (that they don't provide the info) but rather that Browsers don't sent the location hash (#) part of the URL to servers because historically the #info was used for on-page anchors. Now with in-Browser Web apps using in-situ Javascript smarts and doing routing with the location hash (cf. Sammy), it would be nice for Browsers to send the location hash content to the server, though I doubt that will ever happen.
ReplyDelete@Zhami: Ah yes. I incorrectly assumed it was a server issue. http://en.wikipedia.org/wiki/Fragment_identifier#Processing
ReplyDeleteOkay, so I get that you can call the OAuth 1.0 access_token method with the bridge code to get a permanent and long lasting token, but how can I obtain the bridge code via the normal @anywhere authentication mechanism? I see it appear in the popup just after authentication, but the window disappears and I don't know how or where to get it from after that.
ReplyDeleteHah. Never mind. Found it here: http://www.slideshare.net/themattharris/twitterapi-at-socialapp-workshop-4829646
ReplyDelete(Go to slide 51).
@Otto: I have a blog post coming that covers all of that in detail.
ReplyDeleteHi
ReplyDeleteI have an application that when we try to post a tweet, it uses OAuth to allow the user to "Auth" the connection. It's then stored in the twitter profile for that user as a connection (great).
However, every time they post a new tweet, it continues to ask them to Auth.
I was under the impression that once the user had "Auth'd" once, they shouldn't be asked every time.
What are we doing wrong?
Your help is much appreciated.
Mike: it depends on how you are authenticating. @anywhere for example requires users to connect every couple of hours. That is how Twitter has it set up and it can not be changed. Sign in with Twitter depends on the websites session handling in which case cookies might not be getting set properly or might be to short livid.
ReplyDeletehave tried it. but isnot working. it doesnt work now, right?
ReplyDeleteTwitter changed how @anywhere authenticates so this doesn't work anymore. They might have just changed it but I have not had time to see what they changed it.
ReplyDeleteTwitter changed how @anywhere authenticates so this doesn't work anymore. They might have just changed it but I have not had time to see what they changed it.
ReplyDeleteMike: it depends on how you are authenticating. @anywhere for example requires users to connect every couple of hours. That is how Twitter has it set up and it can not be changed. Sign in with Twitter depends on the websites session handling in which case cookies might not be getting set properly or might be to short livid.
ReplyDeleteHah. Never mind. Found it here: http://www.slideshare.net/themattharris/twitterapi-at-socialapp-workshop-4829646
ReplyDelete(Go to slide 51).
This is a very helpful write-up. Thanks.
ReplyDeleteRight now, I'm trying to figure out how to retrieve the URL fragment (stuff after the #) in PHP. Seems the query query string doesn't provide access to anything after a pound sign.
It looks like Twitter stopped accepting bridge codes:
ReplyDeletehttp://groups.google.com/group/twitter-development-talk/browse_thread/thread/50fcc4f28cd6b659/