Use OAuth Echo

OAuth Echo is a means to securely delegate OAuth authorization with a third party while interacting with an API. For example, you may wish to verify a user’s credentials from your app’s server (the third party) rather than your app.

More technical information about OAuth Echo can be found here.

Instantiating OAuthSigning

OAuthSigning relies on the TwitterAuthConfig as well as a TwitterAuthToken.

The TwitterAuthConfig class encapsulates the credentials to identify your Twitter or Digits application. You can get this object from the TwitterCore class.

The TwitterAuthToken class represents the user credentials of a Twitter of Digits user. You can get this object from a TwitterSession or DigitsSession.

TwitterAuthConfig authConfig = TwitterCore.getInstance().getAuthConfig();
TwitterAuthToken authToken = session.getAuthToken();

OAuthSigning oauthSigning = new OAuthSigning(authConfig, authToken);

Creating OAuth Echo headers

The easiest way to use OAuth Echo is by requesting the headers to make a request to verify_credentials from outside the app.

Map authHeaders = oauthSigning.getOAuthEchoHeadersForVerifyCredentials();

Once you have the headers, you can relay those to your backend to verify the credentials of the user session in your application.

URL url = new URL("http://api.yourbackend.com/check_credentials.json");
HttpsURLConnection connection = (HttpsURLConnection)url.openConnection();
connection.setRequestMethod("GET");

// Add OAuth Echo headers to request
for (Map.Entry entry : authHeaders.entrySet()) {
  connection.setRequestProperty(entry.getKey(), entry.getValue());
}

// Perform request

The authHeaders map contains the X-Auth-Service-Provider and X-Verify-Credentials-Authorization keys. Your backend should take the value in X-Verify-Credentials-Authorization, and use it to set the Authorization header for a request to the URL in X-Auth-Service-Provider.