Authenticating other Users from my App - Tweepy

[im_rickjamez]

Hi,

I’ve created an app in python to like tweets by hitting the POST endpoint -very simple.

Next I’d like to have an account different than mine able to login and authenticate to use the feature.

I have no clue how to do that and would appreciate any advice
I’m a junior dev, just starting to mess around with an API

for background: I’m going to implement this in flask but for now, just have a python like.py file with basic logic in it for my dev account authentication

import tweepy
import config
import time

client = tweepy.Client(
    bearer_token=config.bearer_token,
    consumer_key=config.consumer_key,
    consumer_secret=config.consumer_secret,
    access_token=config.access_token,
    access_token_secret=config.access_token_secret
)


print('Sup Loser, what you wanna like? \n')
search = input('query: ')

query= f'{search} -is:retweet -has:media -is:reply'
response = client.search_recent_tweets(query=query, max_results=42)

for tweets in response.data:
    id = tweets.id
    print(f"searching '{search}' liking tweet -- ID# {id} -- URL https://twitter.com/twitter/statuses/{id}")

    time.sleep(1)
    client.like(id)

[notpickard]

Hi @im_rickjamez,

When you say you’d like an account different than yours to be able to use you app, you mean without the other account needing to go through all of the process of creating their own developer account, registering an app, to get access tokens/consumer keys/access secrets, etc?

In other words let a general Twitter user to be able to authorize your app to do something on their behalf with that “Authorize App” workflow?

Just checking I get the use case.

Best of luck,
rdp

[im_rickjamez]

yes ser,

Exactly

[notpickard]

Got it. I hadn’t noticed that you tagged the post with OAuth before I responded. Thanks for confirming.

This is a bit of a long response, but the TLDR is OAuth 2.0 Native App is what i think you want. I have a gist here for pytwitter-2 (I haven’t tried tweepy) module that handles OAuth2.

The long version continues:

I believe OAuth2.0 is the way to go for this. Specifically a Native App type of app in the Twitter registration process.

The reason for a “Native App” is that all your code needs is the Client ID value, which is not secret or sensitive. It uses temporary access keys that expire for acting on a user’s behalf. It’s less likely that a secret gets checked into source control or mishandled or whatever.

The downside is the OAuth is kind of a nightmare and is generally poorly documented.

Also it requires user interaction. The aforementioned “Authorize App” click the user needs to do. So your project can’t run headless. That makes sense since you’re trying to have a user approve your code to something on their behalf. But creating a development environment to do that was, in my experience, glossed over in example code, documentation, etc.

It does work but there are bunch of places that can fail without a clear explanation of why or how to resolve it.

Despite the short comings, the security upside of not having to sensitive material like long term access token secrets is worth it.

In brief OAuth works by (1) your app creating a Twitter URL with the Client ID of your registered app and callback URL, (2) the user opening that URL, (3) Twitter having the user confirm (this assumes the user is already logged into Twitter in their browser), and if the user confirms Twitter (4) redirecting the user’s browser to the specified callback URL with some parameters. The parameters passed to back to your app through the callback URL can be used to create a temporary bearer token that will let your app act on behalf of the user that approved your app.

Pretty much all of those steps, like creating the Twitter URL and synthesizing the bearer token from the parameters passed to your app from Twitter, are implemented for you in the libraries like pytwitter and i’m assuming tweepy. But “catching” the callback in step 4 of the process. It’s totally doable, but just not very clear how to do it.

A couple of things that aren’t very well documented.

The bearer token your app creates only lasts for 2 hours or less (how it’s configured now, but that value is arbitrary and Twitter could change it). So your code needs to be able to handle refreshing the token. It’s not a big deal to do, but in some places the documentation says the bearer token doesn’t expire. So it can be a bit confusing.

The callback URLs are also a little bit confusing. Most documentation treats the callback URLs as though your app is already accessible on the greater Internet. A bit of chicken-and-egg problem for development.

Callback URLs can be pointed to “localhost” and the redirection process works fine. Once the user approves the access Twitter just redirects the web browser to whatever callback URL was initially passed in. But setting up an HTTP listener on your app is something that is glazed over in pretty much every example I’ve seen for OAuth.

Another point is that if the callback URL your app passes to Twitter does not exactly match one of the configure Callback URL values in the Twitter app page you will see a “Something went wrong”. It can be a little frustrating to figure out what went wrong with so little feedback.

I have written a wrapper for the pytwitter-2 python module to handle to OAuth 2.0 flow from the app side.

The gist is here. It sets up a HTTP listener, will open a web browser page, handles refresh tokens. Around line 235 is where your logic would come in. Above that is all of the OAuth 2.0 flow stuff.

I hope this is not information overload, but it is a complex process.

Flask is great.

Best of luck

[im_rickjamez]

Firstly,

Thanks a lot man.

I appreciate the time it took for your to write this out.

Im having to read it over and over and it started to make sense.

In tweepy, they have this 3 legged authentication in their docs linked here:
https://docs.tweepy.org/en/stable/authentication.html#legged-oauth

Is this the right authentication method ^

thanks homie!

[notpickard]

Good afternoon @im_rickjamez,

Glad it was a bit helpful.

From the tweepy link you included the method I was referring to is the OAuth 2.0 Authorization Code Flow with PKCE (User Context). From what I can see of the tweepy example code, the OAuth 2 w/ PKCE implementation is very similar to the way the pytwitter module does it. So while I haven’t tried it, it looks like getting a temporary bearer token to be able to make authenticated requests to the Twitter API with a user context is totally doable.

I believe three-legged auth will do what you want, do some work on behalf of a Twitter user, but is more applicable to situations where you want Twitter to be the authenticator of a user on your app. In other words, the “Log in with Twitter” button. In the case I described the app has no persistent user. It’s a one time thing.

Please feel free to post follow up questions you might have. This is helpful for me to refine my understanding of the API as well.

Best of luck,
rdp

[im_rickjamez]

ty ser,

sorry but i think i have a couple more questions, one of which is the callback URI/URL
on StackOverflow, it seems the callback uri/url doesn’t matter when in production, it matters once the app goes live…

what I don’t understand is, could it be a web domain I already own? And if so, there’s no config needed, i can just put a web domain in my possession.

my overall plans:

1. understand what to put in my app configuration for URI/URL to test oauth2
2. configure my CRUD flask app with routes to the endpoints
3. deploy that flask app on neftify or aws or something

But before i do that, is it possible for me to do some testing on the logic of my app before I move to integration with a server (and do it on a domain I already own)

Im asking some dumb questions, trying to conceptualize it all and get proper feedback

I appreciate your time in responding notpickard,

-flaki

[notpickard]

Good evening @im_rickjamez,

No worries. OAuth is kind of confusing, I will try to not make it more so.

Can you point me toward a StackOverflow example?

I was going to write a whole long post again but thought I might be misunderstanding the context and the StackOverflow post would let me double check.

As I understand OAuth 2 the callback URL is necessary to pass control back to your app once the user has approved.

rdp