OAuth and Twitter

 Earlier last month, Twitter released OAuth access to their site and to the API.  Excited about the possibility of integrating some DigitalChalk functions with Twitter, I decided to take a couple of hours to play around with it and see what it offered.  There are lots of examples on the Twitter API site, but none of them are in Java.  What?  Really?  Maybe because it is so easy to do, but I do think that it is worth posting about.  First, a little about the flow of getting your access credentials from Twitter.  The diagram below shows the order of events and some pieces of the data that you need to get started.

For my implementation example I am using a Java OAuth library written by John Kristian, Praveen Alavilli and Dirk Balfanz.

1. You must get your Consumer Key and Consumer Secret by registering your application on Twitter.com

2. The goal is to get an Access Token and Secret that you can use to read and/or write to a Twitter users information without having to ask for their username and password everytime.  We also don't want to have to store that information because they may change it on Twitter.com and we don't want to have to synchronize the information. (The user doesn't really want to give that information to us anyway)
   
3. The first step is get request a Request Token from Twitter.  You do this by using a timestamp, nonce, oauth version, and your consumer key and signing it with your consumer secret.  Then a request can be made to http://twitter.com/oauth/request_token including the signature.
   

public TwitterTokenPair getRequestToken(TwitterConsumerCredentials credentials) throws TwitterOAuthException {
   TwitterTokenPair result = null;
   OAuthAccessor accessor = newAccessor(credentials);
   OAuthClient client = new OAuthClient(new HttpClient3());
   try {
      client.getRequestToken(accessor);
      // Build the token pair to return
      result = new TwitterTokenPair();
      result.setToken(accessor.requestToken);
      result.setTokenSecret(accessor.tokenSecret);
   } catch (Throwable t) {
      throw new TwitterOAuthException(t);
   }   return result;}

4. Twitter will generate a Request Token and Token Secret and send them back
5. Save the Request Token and Token Secret off for later use.  We will use them again after the user has granted us access.
6. Build up a the URL for a user to access, sending them to Twitter, to grant us access.  This will be done by sending them to http://twitter.com/oauth/authorize?oauth_token=.  You can optionally add a callback URL on the parameters or just rely on the one that you entered on the Twitter site when registering your application.

public String getAuthorizeUrl(String token, String callbackUrl, Map callbackParameters) {
   Map parameters = new HashMap();
   parameters.put("oauth_token", token);
   if (null != callbackUrl) {
      parameters.put("oauth_callback", callbackUrl + "?" + asQueryString(callbackParameters));
   }
   return authorizeUrl + "?" + asQueryString(parameters);
}


7. If you user grants you access, then your callback URL will be called.
8. Upon recieving the callback, you now need to request and Access Token from Twitter.  This is very similar to step 3 except you will be using a different URL and the Request Token and Secret that you saved off in step 4.  You will sign your request with your consumer secret and the token secret and send the request for the Access Token to http://twitter.com/oauth/access_token.

public TwitterTokenPair getAccessToken(TwitterConsumerCredentials credentials, TwitterTokenPair requestTokenPair) throws TwitterOAuthException {
   TwitterTokenPair result = null;
   OAuthAccessor accessor = newAccessor(credentials);
   accessor.requestToken = requestTokenPair.getToken();
   accessor.tokenSecret = requestTokenPair.getTokenSecret();
   OAuthClient client = new OAuthClient(new HttpClient3());
   try {
      client.getAccessToken(accessor, HttpClient.GET, null);
      // Build the token pair to return
      result = new TwitterTokenPair();
      result.setToken(accessor.accessToken);
      result.setTokenSecret(accessor.tokenSecret);
   } catch (Throwable t) {
      throw new TwitterOAuthException(t);
   }
   result;
}

9. Twitter will generate an Access Token and Token Secret and send them back.  At this point, the Application is added to the users Connections tab.

10. Once you parse the Access Token and Token Secret out of the response, you can use them from that point forward to make Twitter API calls on behalf of the user that granted access.

That is it!  Now you have successfully acquired the Access tokens and can perform the Twitter REST API services for that user.  Because I have granted DigitalChalk the to update my status, the application can do so at its hearts content.

TwitterHttpCommand twitterCommand = new TwitterHttpCommand(credentials);
try {
   Map parameters = new HashMap();
   parameters.put("status", "Just finished OAuth integration implementation of Twitter and DigitalChalk in Java!  Woohoo!");
   response = service.execute(twitterCommand, HttpMethod.POST, accessTokens, "http://twitter.com/statuses/update.xml", parameters);
   printInputStream(response.getResponse());
} catch (TwitterOAuthException ex) {
   System.out.println(ex);
} catch (IOException ioex) {
   System.out.println(ioex);
}

UPDATE: I have been asked to include the code for this experiment.  You will need to download the Java OAuth Library and include it in the classpath as well as enter your Consumer Key and Secret into the twitter.properties file.  The Test.java class should walk you through how I used it to test access to Twitter.  Let me know what you think and if you would like to see anything else added.  You can download the code here: http://bit.ly/Pz55C