How Does Twitter's OAuth System Work?

Question

I have got a demo script that lets me authorize with my app and sends back my token. But this is confusing.

I have always used username and password in my CURL or simpleXML functions to authorize the API call. I don't understand how this relates to oauth.

I get that I will store the token, but what do I do with it once i have it? Nothing I've found online is clear and it makes the assumption that I'm stephen hawking and already know 9/10ths of what they are talking about.

Help me go from using username and password in the http address, to using my oauth token instead.

Answer 1

I have always used username and password in my CURL or simpleXML functions to authorize the API call. What the hell is going on with this oauth thing by comparison?

Nobody in their right mind should trust their Twitter password to your web application so your application is unable to access Twitter on their behalf. OAuth is a way around this by letting the user selectively grant access for your application to their Twitter account without you knowing the password. That way, the password remains a credential only shared between the user and Twitter and no untrusted third party (you).

That’s what’s up with that crap. _{Try saying it aloud, fast, with a British accent. *scnr*}