From Wikibooks, open books for an open world
Jump to navigation Jump to search

Motivation[edit | edit source]

You want to login to a web service that support the OAuth protocol.

Background[edit | edit source]

OAuth is an open protocol to allow secure API authorization in a simple and standard method from desktop and web applications. Like OpenID, OAuth allows other web services to use your private data without giving out your passwords.

Terminology[edit | edit source]

Consumer Key - When you register as a developer with a OAuth service provider they will send you an API key to use with their service. This is typically about a 65 character string composed of digits and letter.

Service Provider - an organization like LinkedIn, Google, or Twitter that has some of your data protected behind a web service.

Token - a somewhat long string of computer-generated letters and numbers use in AOuth data exchanges. These strings hard to guess, and are paired with a secret key to protect the token from being used by unauthorized parties. OAuth defines two different types of tokens: a request token and access token.

Steps[edit | edit source]

We will perform this process in the following steps:

  1. Request a Token
  2. Sign
  3. etc.

Here is an example of the structure that contains OAuth information (from 28msec web site)

<oa:service-provider realm="example.com/oauth"> 
		<oa:consumer-key>your consumer key</oa:consumer-key>
		<oa:consumer-key-secret>your consumer secret</oa:consumer-key-secret>

References[edit | edit source]