OAuth Token Differences between Facebook and Twitter/LinkedIn

Question

This may very well be an offensively stupid question, but I can't find a quick and concise answer to it for the life of me. So here we go...

I am currently implementing Facebook, Twitter, and LinkedIn Post/Update/Share functionality within a C#/MVC4 web app. I have the appropriate Apps created on each social network, which a user of the web app can authorize (via the standard OAuth dialogues of each network), such that they can send a profile update to several/all networks with one click. I have completed development of this functionality and everything is working as designed; I am now in a phase of refactoring the code and the associated db schema (used for storing the necessary OAuth Tokens for the Apps and Users, extended User Info pulled from the particular network's API, Individual Post metrics, etc.), which is where I am left scratching my head.

Without further adieu... the questions:

1. Regarding OAuth Tokens for Apps: Why does Facebook only provide/require an "App Secret" whereas both Twitter and LinkedIn provide/require both a "Consumer Key" and "Consumer Secret"?

2. Regarding OAuth Tokens for App Users: Why does Facebook only provide/require an "access token" whereas both Twitter and LinkedIn provide/require both an "access token" and an "access token secret"?

Is this simply due to a difference in the OAuth protocol versions implemented by Facebook (2.0 draft 12) vs Twitter and LinkedIn (1.0a), or is it something else completely?

Answer 1

Here are answers to your questions,

1.Facebook do provide both App key and App secret on registering an app as a Facebook developer.

2.Facebook uses OAuth 2.0 so it only provides a access token and refresh token(refresh token is only provided if you ask for offline access while specifying scopes),the access token has validity of 1 hour,after that it gets invalidated,you need to refresh it or get new access token altogether.

This difference is due to variation in OAuth protocol versions OAuth 1.0/1.0a and OAuth 2.0.