Authentication for new Twitter API 1.1

Question

I have an application that needs to display number of followers and following (users/show.json) for a random user on a public page (authentication is not required). With the Twitter API 1.0 it was quite easy as authentication is not needed for the request. With the new Twitter API 1.1 is no more possible, so I need to authenticate the request (via OAuth).

Is it possible only "authenticate" the application and not the user too? I mean: can I avoid to ask user to login and only authenticate with application key/secret? Or everytime I need to create a token with user credentials too, creating callback, etc.?

Answer 1

Yes, it is possible! If your application doesn't need to do things like post statuses or send direct messages on behalf of a user, you should be able to retrieve all of a user's public information with a single hardcoded set of Twitter OAuth credentials, and not require the user to authenticate.

• Login to Twitter and go to the developer dashboard at https://dev.twitter.com/apps
• Register a new application; after the application is registered, view the application details. You'll see an "OAuth Tool" tab, where you'll find all the relevant OAuth values for that application: Consumer Key, Consumer Secret, Access Token, and Access Token Secret.
• Using these credentials, you'll be able to make requests to the new Twitter API.

If you're not comfortable using the Twitter API directly, there are a number of good API wrappers out there for various languages -- among others, the Temboo SDK, which will give you code snippets for calling various methods (and also gives you a place to securely store your Twitter credentials, so you don't need to bake them into your application).

Take a look at:

• UserTimeline
• GetFollowersByID

(Full disclosure: I work at Temboo.)

Answer 2

The easiest way to do what you're asking is to use Twitter API 1.1's 'application-only authentication' feature, which works for much of the API. See Application-only authentication. You can see a Python example of it in get_bearer_token.py.

Once you have a bearer token, you only need to include that in your request authorization header - signing is not necessary.