We use the Doorkeeper gem for OAuth, so you can refer to their docs on specifics of the end-points.
The API is divided up into access scopes:
read: Read data
write: Post statuses and upload media for statuses
follow: Follow, unfollow, block, unblock
Multiple scopes can be requested during the authorization phase with the
scope query param (space-separate the scopes). If you do not specify a
scope in your authorization request, the resulting access token will default to
One possible way this might work for you:
client_secretfrom your local cache. If you don't have the two, you need to register the application. Store
client_secretin your local cache for next time. We actually don't need the
idreturned from this call.
- Get the
refresh_tokenfrom your local cache. If you have one, any access token you might have has probably expired anyway. Refresh by visiting
/oauth/tokenusing a POST request with the parameters
client_id=<client_key>(yes, this is confusing!),
refresh_token=<refresh_token>. Save the
access_tokenyou get back in your local cache.
- Get the
access_tokenfrom your local cache. Try to connect. One simple way to do this is to verify credentials. Whatever API call you make, add the HTTP header
Authorization: Bearer <access_token>.
- If you have neither refresh nor access token, tell the user to visit
scope=read write follow(URL encode the space to
%20, of course),
redirect_uri=urn:ietf:wg:oauth:2.0:oob(assuming you don't want to redirect your users elsewhere),
client_id=<client_key>(yes, this is confusing). The user clicks on the URL and gets shown a page asking them to authorize your app for reading, writing, and following (assuming this is the scope you requested, feel free to request less). If the user clicks on the right button, they get back a code. Store this code as your
refresh_token. Go back to step #2.