OAuth 2.0 Tokens and Twitter API: Everything You Need to Know

OAuth2 flow for Twitter

+--------+                                   +---------------+
|        |--(A)- Authorization Request ->    |               |
|        |                                   |               |
|        |<-(B)-- Authorization Grant -------|               |
|        |                                   |               |
|        |                                   | Authorization |
|        |                                   |     Server    |
|        |                                   |               |
|        |--(C)-- Authorization Grant -->    |               |
|        |                                   +---------------+
|        |           
|        |                                   +---------------+
|        |--(D)-- Access Token Request -->   |               |
|        |                                   |               |
|        |<-(E)------ Access Token --------- |               |
|        |                                   |   Resource    |
|        |                                   |     Server    |
|        |                                   |               |
|        |--(F)------ Access Token ------>   |               |
|        |                                   +---------------+
|        |

Steps :

1. Create Twitter developer account and verify phone number.
2. Enter your usecase and agree to their terms.
3. You will be directed to Twitter Dashboard with a project created.
4. Click on keys & tokens -> Regenerate API Key & Secret under Consumer Keys and Bearer Token , Access Token & Secret under Authentication Tokens and save it for future use.

5. Go to the project in developer portal and setup user authentication

6. Give the app permission to Read and write and direct message

Type of app -> Native App

7. In the app info, add http://127.0.0.1 in the callback uri

Add website url as seen in your browser

https://developer.twitter.com/en/portal/projects/1648328711593181184/apps/26952311/auth-settings

change auth-settings in the last to settings

https://developer.twitter.com/en/portal/projects/1648328711593181184/apps/26952311/settings

and save it.

8. On completing this steps, you will get Client ID & Client Secret.

9. Add the Client ID generated from step 8 to the following url and get the authorization code from the browser

https://twitter.com/i/oauth2/authorize?response_type=code&client_id=<client-id>&redirect_uri=http://127.0.0.1&scope=tweet.read%20users.read%20follows.read%20offline.access&state=state&code_challenge=challenge&code_challenge_method=plain

You will be asked to Authorize the app so that third-party application can access your Twitter data on your behalf.

User will be redirected to Twitter’s authorization URL, which looks like this

http://127.0.0.1/?state=state&code=TEsjdajdbhahbMQm92ODE4MzAzNzI2Nzc6MToxOmFjOjE

Tip : There is 30 sec expiry limit on the authorization code generated from the browser.

10. Generate Access Token

Make a curl request to https://api.twitter.com/2/oauth2/token with authorization code got from step 9 and Client ID within 30 seconds of the code generation

curl --location 'https://api.twitter.com/2/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Cookie: guest_id=v1%3A166539399762736297; guest_id_ads=v1%3A166539399762736297; guest_id_marketing=v1%3A166539399762736297; personalization_id="v1_VfKYUIP1Z7FdzmaqEs4KTw=="' \
--data-urlencode 'code=<authorization-code>' \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'client_id=<client-id>' \
--data-urlencode 'redirect_uri=http://127.0.0.1' \
--data-urlencode 'code_verifier=challenge'

You will get json response of following type

{
    "token_type": "bearer",
    "expires_in": 7200,
    "access_token": "WWxlQnkzdWczMmdUZXo4d2514MTY6MToxOmF0OjE",
    "scope": "users.read follows.read tweet.read offline.access",
    "refresh_token": "X0ZaTWJHBvRGZselk3bGZNa1dZMHlBOjE2ODE4MzA5NTEnJ0OjE"
}

11. Access Twitter’s data using the Access Token

• Get single Tweet by Tweet ID

curl --location 'https://api.twitter.com/2/tweets/1307290179556630528' \
--header 'Authorization: Bearer <access-token>' \
--header 'Cookie: guest_id=v1%3A166539399762736297; guest_id_ads=v1%3A166539399762736297; guest_id_marketing=v1%3A166539399762736297; personalization_id="v1_VfKYUIP1Z7FdzmaqEs4KTw=="'

Json response:

{
    "data": {
        "edit_history_tweet_ids": [
            "1307290179556630528"
        ],
        "id": "1307290179556630528",
        "text": "Brothers in the air 😃 @ABdeVilliers17 https://t.co/hf0oeB9Z0h"
    }
}

• Get multiple tweets by Tweet ID

curl --location 'https://api.twitter.com/2/tweets?ids=1579329448390037504%2C1307290179556630528%2C1575743933799243777%2C1576643915322564609%2C1579397173464117249%2C1579324694041591808' \
--header 'Authorization: Bearer <access-token>' \
--header 'Cookie: guest_id=v1%3A166539399762736297; guest_id_ads=v1%3A166539399762736297; guest_id_marketing=v1%3A166539399762736297; personalization_id="v1_VfKYUIP1Z7FdzmaqEs4KTw=="'

The following collection contains the curl request for data of lookup tweets, users by ID or username, followers or following of the user, list of tweets, list of members, create/delete tweet, recent search, full archive search, liked tweets and many more..

Twitter API v2 | Abhiruchi OAuth Postman Collection

Token uri : https://api.twitter.com/oauth/request_token

Auth uri : https://api.twitter.com/oauth/authorize

Troubleshooting

• If you are getting such error

{
    "client_id": "96251321",
    "detail": "When authenticating requests to the Twitter API v2 endpoints, you must use keys and tokens from a Twitter developer App that is attached to a Project. You can create a project via the developer portal.",
    "registration_url": "https://developer.twitter.com/en/docs/projects/overview",
    "title": "Client Forbidden",
    "required_enrollment": "Appropriate Level of API Access",
    "reason": "client-not-enrolled",
    "type": "https://api.twitter.com/2/problems/client-forbidden"
}

Resolution : Create a Project via the Twitter Developer Portal and then attach a Twitter developer App to it. Navigate to the project by clicking on the project name in the “Projects & Apps” tab and delete the old app. Create new app , get your keys & tokens , go to App settings and follow all the steps from step 5.

References

OAuth 2.0 Making requests on behalf of users

Using Twython to send a tweet, twitter api error