PHP, Twitter and OAuth

2010-11-29

Well ain't that a pain in the .... A few months back Twitter disabled their plain http authentication and enforced OAuth instead. This basically meant changing from a simple password mechanism to a rather complicated one. Not quite as trivial. Oh and breaking many existing apps in the process, but I guess they didn't care so much about them.

Anyways I spent a while at getting this right, so here's a really simple way of getting access to the Twitter api using OAuth. My method uses this library provided by Tijs Verkoyen. At the time of writing, 2.0.3 is the latest version, but I had to use 2.0.2 to get it to work. I kept getting Incorrect signature with the newer version of the lib (and the exact same script). So if that problem led you here, go downgrade :p

OAuth works with a three way handshake. You first ask it for a temporary token. You send the user to Twitter with the temp token so the user can tell Twitter your app can access his account. After that succeeds Twitter will send the user back to a page defined by you. This should be your server and the page the user is sent back to will have two url parameters appended; oauth_token and oauth_token_secret. To finalize you need to use these tokens to get the actual oauth token and secret for this user for your app. After that you can use these tokens to make whatever api calls you desire.

So how does this work with the library? First the authentication page:

Code: (php)
// this is the twitter library by Tijs
require_once 'twitter.php';
// fetch these from dev.twitter.com, they tell the server which app you are
$appToken = 'abcdef';
$appSecret = 'ghijkl';
// create instance
$twitter = new Twitter($appToken, $appSecret);
$callback = 'http://your.domain/callback.php';
// now ask for temp token. the user will go to twitter.com and return to $callback
$response = $twitter->oAuthRequestToken($callback);
// send user to twitter to auth, using the requested token
$twitter->oAuthAuthorize();
// will be sent back to $callback

Now the callback page.

Code: (php)
// this is the twitter library by Tijs
require_once 'twitter.php';
// fetch these from dev.twitter.com, they tell the server which app you are
$appToken = 'abcdef';
$appSecret = 'ghijkl';
// create instance
$twitter = new Twitter($appToken, $appSecret);
// this page will be called with ?oauth_token=xxx&oauth_verifier=xxx
// now finalize authentication by sending these tokens back to twitter
$response = $twitter->oAuthAccessToken($_GET['oauth_token'], $_GET['oauth_verifier']);
// $response should now contain the token and secret token from the user, as well
// as the user id and user name. Save these somewhere to use in subsequent requests.
// Handshake complete

And requesting the stream from the same user.

Code: (php)
// this is the twitter library by Tijs
require_once 'twitter.php';
// fetch these from dev.twitter.com, they tell the server which app you are
$appToken = 'abcdef';
$appSecret = 'ghijkl';
// create instance
$twitter = new Twitter($appToken, $appSecret);
// set tokens as received from twitter after authentication
$twitter->setOAuthToken($token);
$twitter->setOAuthTokenSecret($secret);
// now do whatever you want to do
$response = $twitter->statusesHomeTimeline(false, false, 200);
echo $response[0];

Of course this example has no error checking whatsoever, so you'll have to take care of that yourself. It is just meant to show you the three simple steps required to get things working.

Hope it helps you! :)