What is oauth_token_secret in Twitter OAuth

Question

When I get an access token from Twitter I get something like the following:

oauth_token=14410002-F5Bi8hMpQbXamM8MBBw8zw2LYIBL4FEBvxLZfaSwX&oauth_token_secret=K8QNvDcC2f9qtGU8tfa75exwLZ2Sc1jeHrThnk6Co&user_id=14410002&screen_name=blueonion 

What is the oauth_token_secret? Is that what is used to sign protected requests or is the consumer_key still used.

Answer 1

The short answer is: The oauth_token and the oauth_token_secret both make up the Request token which is used to sign requests.

Here are some resources which might help:

• the OAuth specification (esp. section 6)
• Twitter Single-user OAuth with Examples
• The terminology part of the OAuth guide

This is not the consumer key. The consumer key is only used for identifying the consumer (= the code which calls Twitter) while the Request Token is bound to the user. The Request Token consists then of a public and a secret part which are both used for signing the request as explained in the specification in section 9.

But you probably want to use one of the libraries and have a look at the examples.