Possible to Tweet to Multiple Twitter Accounts Using One Developer Account?

[thatAntinomy]

Hi There, I know this is most likely not possible but still want to ask here to double check. I am working on a video game like installation that is designed for an art museum in New York. In this game there are a few characters, each character will have its own twitter account, and they will share their statuses through their own twitter accounts. Which, requires us to create multiple accounts for them AND have them all approved as developer accounts. Given the time that takes for a new account to get approved it will be a lot of work and wait. So our team is really interested to know if there are easier ways to handle this. For example - just use one approved account and tweets to multiple accounts?

Thanks!

[Connexinet]

Hi there,
You don’t need multiple developer accounts, you need one app and one account.
Then each of your twitter account needs to authorize your app to post on their behalf, and then post for that account.

Basically you start here:
https://developer.twitter.com/en/docs/basics/authentication/overview/oauth

Then you use this endpoint
https://developer.twitter.com/en/docs/tweets/post-and-engage/api-reference/post-statuses-update

Hope this helps

[thatAntinomy]

thanks for your answer. You are basically saying to let the user authorize the app to post on their behalf, right? I understand this is a typical usage, but in my case, I only want to post to this 4 twitter accounts and they all pre-created, and all belong to my team. The authorization and posting actions need to be done completely under the table without the user of the app knowing at all.

If this is the case, is it still possible to use the approach you suggested?

[Connexinet]

I am not sure what you mean by “user of the app”
By user you mean, one of the 4 accounts you created? If so, yes absolutely, you clearly have the password for these accounts, so you simply login to twitter and authorize your app to write to these 4 accounts, then your backend can post to these accounts at any time.

[thatAntinomy]

thanks. i am reading the doc about the 3-legged auth, it says:

• The user will always be prompted to authorize access to your application, even if access was previously granted.

what I want is to have the app is installed on a user’ phone, and boom the app can start tweet to multiple pre-set accounts without the user knowing and doing anything. is this possible using the approach you mentioned?

[Connexinet]

Yes, the text is referring to authorizing the app, if you use this app to login to your website they will always be prompted. If you don’t want them to be prompted on subsequent attempts you need to use the authenticate endpoint: https://developer.twitter.com/en/docs/basics/authentication/api-reference/authenticate.html

But I don’t understand what you mean by “have the app is installed on a user’ phone”. Which user? Which phone? I thought your users are just the 4 bot accounts, and the app is installed somewhere on your server to post game stats.

[thatAntinomy]

sorry for not making it clear.

let’s say my team has 4 prepared accounts, A, B, C and D.

the app is available on App Store, which is available to the public. One user downloads the app, and starts using it, when the user is playing with the game/app, the app generates new content, and the app starts tweeting. Sometimes it tweets to account A, sometimes it tweets to Account B.

Under this assumption, 1. the twitter accounts are prepared already. 2. the tweets are generated on the client side. 3. the user doesn’t need to do anything on any part of the tweeting.

[Connexinet]

OK I get it, you have two type of apps (mobile app and twitter app) and two types of users (mobile user and twitter user).

So the secure way is to:

1. Install the app on your server, and authorize the twitter users (bots) on your app (and store the authorization tokens). This step is done by you, not the mobile user.
2. When the mobile app generates content it will send the content to your server which will send the tweets using authorization tokens obtained from step 1

If you want to do the tweeting from the client directly without the server, you can store your access tokens (in step 1) with the app (encrypted), and call the twitter API directly from the mobile app using these tokens. But this is the less secure choice, since your key is deployed with the mobile app and leaves little room to change the keys etc (in case of security breach or if you want to revoke them you must update the mobile app)

[thatAntinomy]

you can store your access tokens (in step 1) with the app (encrypted),

Do i need to have account ABCD to all get approved as developer accounts to get the access tokens? or there is another way to do it?

[Connexinet]

No, ABCD are not developers, they are users. The only developer is you.
They can get access token by implementing this:
https://developer.twitter.com/en/docs/basics/authentication/overview/oauths
Just to be clear, you do this part on your own, your end user (mobile app user) has nothing to do with this.

[thatAntinomy]

the link you provided here leads to an error page. did you mean this link instead?
https://developer.twitter.com/en/docs/basics/authentication/guides/access-tokens.html
to get the access token i have to have the four accounts approved as developer account, right?

To generate your access token and secret, you must have a Twitter app.

If you need to create a Twitter app, you must do so through the developer portal with an approved developer account

OR, i can only have 1 developer account and i can use that account to tweet to ABCD four accounts?

So, to rephrase my question given what we have talked about here: Is it possible to obtain an access token for a regular twitter account (not approved as a developer) owned by myself and tweet on its behalf without any prompt to the person who is using the app? If possible, any documents i can read or follow?

[Connexinet]

Sorry about the broken link, it should be this:
https://developer.twitter.com/en/docs/basics/authentication/overview/using-oauth

You need 1 developer account, you will not get approved for 4 accounts. So just create one (if you haven’t already) and then create the twitter app.
Then once you have the twitter app, create access tokens for each of the 4 accounts using this:
https://developer.twitter.com/en/docs/basics/authentication/overview/using-oauth
You can do this all using twurl

twitter/twurl

Or postman

But it might be worthwhile to build a backend for this, in case you need to recreate the tokens (they do expire at times, or get invalidated)
Not sure what your background is, but here is an example for .Net

Twitter external login setup with ASP.NET Core

or php:

abraham/twitteroauth

So in short, yes, it is possible. The access token is basically what allows an app to post on any account thatpermits it, there are apps with access tokens to millions of accounts.

[thatAntinomy]

Hi, I came to say thank you for your enormous patience. I used twurl to complete the permission-giving and found all the keys inside .twurlrc file. all work well now.

if anything, can you point to a place I can start looking into how to store the credentials on a server and query it when using to ensure maximum security?

Thank you very much!

[Connexinet]

No problem! I am glad I could be of help.

Security is complicated, it really depends on how much security you want to add, but I highly recommend you encrypt your tokens when you store them, ideally with salt.
Granted your app will be used by 4 users, so you don’t need to go all out, but some level of encryption is a must.

Cheers

[system]

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.