OAuth Echo is a means to securely delegate OAuth authorization with a third party while interacting with an API.

For example, you may wish to verify a user’s credentials from your app’s server (the third party) rather than your app.

More technical information about OAuth Echo can be found here.

Instantiating TWTROAuthSigning

TWTROAuthSigning relies on the application auth config as well as a user session, either from Digits or from Twitter.

The TWTRAuthConfig object encapsulates the credentials to identify your Twitter or Digits application. You can get this object from the Twitter class (see code examples below).

An TWTRAuthConfig object represents the user credentials of a Twitter of Digits user session. Both the TWTRSession and the DGTSession classes conform to this protocol.

// Objective-C
// Instantiates TWTROAuthSigning
TWTROAuthSigning *oauthSigning = 
            [[TWTROAuthSigning alloc] 
            initWithAuthConfig:
                [Twitter sharedInstance].authConfig 
                authSession:[Twitter sharedInstance].session];

// Swift
// Instantiates TWTROAuthSigning
let oauthSigning = TWTROAuthSigning(
          authConfig: Twitter.sharedInstance().authConfig, 
          authSession: Twitter.sharedInstance().session())

Creating OAuth Echo signing headers

The easiest way to use OAuth Echo is by requesting the authorization headers to make a request to verify_credentials from outside the app.

// Objective-C
NSDictionary *authHeaders = 
        [oauthSigning OAuthEchoHeadersToVerifyCredentials];

// Swift
let authHeaders = oauthSigning
        .OAuthEchoHeadersToVerifyCredentials()

The authHeaders dictionary contains the X-Auth-Service-Provider (defined in the TWTROAuthEchoRequestURLStringKey constant) and X-Verify-Credentials-Authorization (defined in the TWTROAuthEchoAuthorizationHeaderKey constant) keys. Your backend should take the OAuth signature in X-Verify-Credentials-Authorization, and use it to set the Authorization header for a request to the URL in X-Auth-Service-Provider.

// Objective-C
NSMutableURLRequest *request = 
  [NSMutableURLRequest requestWithURL:
    [NSURL URLWithString:
      @"http://api.yourbackend.com/check_credentials"]];
request.allHTTPHeaderFields = authHeaders;

// Swift
let request = NSMutableURLRequest(
  URL: NSURL(string: 
    "http://api.yourbackend.com/check_credentials"))
request.allHTTPHeaderFields = authHeaders