oAuth 2.0, access_token, Facebook, Twitter

Question

I spent a lot of time looking for any clarifications about using oAuth with FB and Twitter. I have to do application which will be using access_token. This token will be used also on diffrent devices to access user account via API. When I'm looking for "how to use access_token" I only finding "how to get token". If I something miss reading documentation please let me know, especially where is example - how to use this token on other devices to access API to send eg. post. I have found Twiiter4j and Facebook4j these libs helped me... I've got this access_token and now what next, how connect to API... I know that it's no possible to get access to Twiiter API - ok, but what about FB and "client side"

please help.

Answer 1

Oauth can be complicated so let me try to explain it simply.

1. User visits your website
2. Your website checks if it has seen this visitor before (usually with a cookie)
3. If not, send them to FB/Twitter/Whatever's oauth url. In that redirect, we tell FB/Twitter/Whatever that we're going to need x,y,z permissions (access a users timeline, see a users friends, etc). We also tell FB/Twitter/Whatever that when the user says ok, send them back to www.myurl... Finally, we take everything in this request and "encrypt" it, to prove it's really our site asking. The key to this is only saved on our backend, so the frontend (javascript/html) never sees it.
4. FB/Twitter/Whatever sees the request. They also see the "encryped" form of the requests. Fb/Twitter/Whatever knows this key too (they gave it to us, it's usually called the "secret" when you're configuring your oauth) They can verify it's really your backend asking for permission.
5. If the user agrees, we get a token. We store that token (on our backend, php, java, ruby, etc) and remember it belongs to that user.

The main thing to stress here is that in order to do the oauth handshake, you need a secret key that you never output to the browser. That means you'll need to implement part of this on your backend. You've tagged this with java so maybe that means you're using java as your backend, maybe with Google app engine or something. You'll need to find the oauth library for that, and work it out from there.

You can't create the oauth handshake only with frontend code.