Discussion around the release of application-only authentication

RafaelAlbany · 2013-04-09T16:37:49.000Z

The calls with the application-only auth still don’t work with interpolated parameters?

halekpetigo · 2013-04-12T17:27:34.000Z

Figured it out. No need to add the opening and closing brackets to the tokens…

Ershad · 2013-04-16T16:16:00.000Z

POST http://api.twitter.com/oauth2/token
Accept: /
Host: api.twitter.com
Authorization: Basic a2c5Rg…QzaFdGdlRtSkQ1VmJ4cXMxZVk=
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials

– response –
403 Forbidden
Cache-Control: no-cache, max-age=300

Content-Encoding: deflate

Content-Type: text/html; charset=utf-8

Date: Tue, 16 Apr 2013 16:14:07 GMT

Expires: Tue, 16 Apr 2013 16:19:07 GMT

Server: tfe

Set-Cookie: dnt=; domain=.twitter.com; path=/; expires=Thu, 01-Jan-1970 00:00:00 GMT _twitter_sess=BAh7DjoJdXNlcmkE1nD6DDobc2Vzc2lvbl9wYXNzd29yZF90b2tlbjAiCmZs%250AYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6%250ACkB1c2VkewA6EHN0YXlfc2VjdXJlVDoPY3JlYXRlZF9hdGwrCGKr8BI%252BAToO%250AcmV0dXJuX3RvIgGKaHR0cHM6Ly90d2l0dGVyLmNvbS9pL3Byb2ZpbGVzL3No%250Ab3cvRXJzaGFkL3RpbWVsaW5lL3dpdGhfcmVwbGllcz9pbmNsdWRlX2F2YWls%250AYWJsZV9mZWF0dXJlcz0xJmluY2x1ZGVfZW50aXRpZXM9MSZtYXhfaWQ9MzIy%250ANzc1MTM1MzEwNDU4ODc5OhNwYXNzd29yZF90b2tlbjA6DGNzcmZfaWQiJWZh%250AZjdiYzNjZTAyMJlMzdkYWY3ZGRhNDViZjRjOgdpZCIlODg0MjYxMGY5%250AZjE3MjlmOTc2ODc0OGU3ZTYyMjMyMzQ%253D–7732887b0c6bb09d7fd04e67da8afe70e6ba6271; domain=.twitter.com; path=/; secure; HttpOnly

Status: 403 Forbidden

Strict-Transport-Security: max-age=631138519

Vary: Accept-Encoding

X-Frame-Options: SAMEORIGIN

x-transaction: 4dde4996295156cb

x-xss-protection: 1; mode=block

X-Firefox-Spdy: 3

403 Forbidden: The server understood the request, but is refusing to fulfill it.

episod · 2013-04-16T16:19:58.000Z

Using the same credentials and curl on the command line are you able to make this request successfully? What’s the consumer key you’re using in this case? Consider starting a new topic to discuss your issues further.

spreadit · 2013-04-19T13:23:59.000Z

There is no option to add an app and generate those keys via the api if I read it correctly.

Meaning that if we want to offer a twitter module to our customers and can’t use our own app because of the number of sites because of the api limits, that means we need to register the app for every twitter module seperately?

lindsaybernath · 2013-04-23T17:40:50.000Z

I would love to have a “Generate Bearer Token” option in the My Applications section. @episode, can you comment on this?

testapps89 · 2013-04-24T10:19:00.000Z

can any one give an example for app only auth in objective -c.how to use app only auth in ios

episod · 2013-04-24T15:00:29.000Z

We’d like to provide it but haven’t had a chance to implement yet. Definitely on the list of things we want to do soon.

jonlmoores · 2013-05-08T10:06:41.000Z

I am still getting the issue as described in #1022. A call to /1.1/account/rate_limit_status.json from an application only context returns:
{“message”:“Your credentials do not allow access to this resource”,“code”:220}

The last update on the issue suggests its just the /trend methods that are still having issues?

episod · 2013-05-08T14:32:11.000Z

And you’re still able to make other requests with the same bearer token?

Are you sure you’re using the right method? In 1.1 the method is /1.1/application/rate_limit_status.json not /1.1/account/rate_limit_status.json

jonlmoores · 2013-05-08T14:38:55.000Z

Yes we can make other requests so the bearer token is valid.

I have asked the developer using this as to what he is trying to do. Changing this to /application works ok.

Thanks

yamamo · 2013-05-08T16:50:08.000Z

Do you have plans to support the Streaming API ?
If yes, when ?

/statuses/filter.json

episod · 2013-05-09T14:35:34.000Z

App-only auth would make an ideal fit with the Streaming API model, but it’ll be a good amount of time before we’re able to support that use case – the Streaming API is still a very user-centric role system and we’d first need to migrate to an application-based system.

HarshithSK · 2013-05-19T16:58:34.000Z

Can’t we make w/o Twitter’s Client Authorization? ? I wanna direct Login.?

lucisferre · 2013-05-21T01:07:08.000Z

So can you use this with JSONP requests? I’ve tried including the bearer token in an ‘Authorization’ query parameter but I’m getting no luck.

episod · 2013-05-21T15:02:48.000Z

We generally discourage use in client-side contexts. You would need to send the bearer token using a HTTP Authorization header.

corbanb · 2013-05-30T19:46:52.000Z

Is there a problem with app only auth using the favorites/list api? How can we tell in the docs what api’s app only auth can use?

I keep getting:

{“errors”:[{“message”:“Your credentials do not allow access to this resource”,“code”:220}]}

episod · 2013-05-30T20:05:41.000Z

favorites/list should be open for app-only auth use. You can tell methods we have available for app-only auth through a few methods:

a) on the individual doc pages, it’ll list a per-app limit in the “info box” on upper-right hand side: [node:10602]
b) on the [alias:/docs/rate-limiting/1.1/limits, title=“rate limit index”] page.
c) by using [node:10280] with a bearer token

It’s odd that you’re getting that specific error with this request. Can you detail how you’re formulating it? Are you specifying a screen_name or user_id as part of the request?

corbanb · 2013-05-31T16:18:00.000Z

Its a very straight forward request being done. Just passing over the Bearer token and a screen name with a count. Below is the exception being thrown.

Message: Client error response [status code] 403 [reason phrase] Forbidden [url] https://api.twitter.com/v1.1/favorites/list.json?screen_name=corbanb [request] GET /v1.1/favorites/list.json?screen_name=corbanb HTTP/1.1 Host: api.twitter.com Authorization: Bearer {my_bearer_token} User-Agent: Guzzle/3.1.2 curl/7.24.0 PHP/5.3.15 [response] HTTP/1.1 403 Forbidden content-length: 91 content-type: application/json; charset=utf-8 date: Thu, 30 May 2013 16:10:13 UTC server: tfe set-cookie: guest_id=v1%3A136993021324735960; Domain=.twitter.com; Path=/; Expires=Sat, 30-May-2015 16:10:13 UTC strict-transport-security: max-age=631138519 {“errors”:[{“message”:“Your credentials do not allow access to this resource”,“code”:220}]}

episod · 2013-05-31T16:19:26.000Z

It looks like you’ve got a “v” in the version part of that path – I think you want https://api.twitter.com/1.1/favorites/list.json?screen_name=corbanb