Home/ Questions/Q 6964965
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T15:59:31+00:00

Let’s say I am making a sign up form in which I asked user’s

  • 0

Let’s say I am making a sign up form in which I asked user’s twitter ID. How do I verify if the ID entered by user belongs to him/her? In case of verifying email we simply send a verification link which user has to click so how do I verify twitter ID? I have never used twitter before.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The only reliable and practical way to verify that twitter account X belongs to user Y this to do full on “3 legged” OAuth authentication. That being said, you may want to consider if you might be OK with just taking the user at their word on it.

    Getting OAuth to work and securely storing the resulting tokens is much easier nowadays than it once was, but is still non-trivial.

    Reasons to verify the twitter account, in increasing reasonableness:

    1. You will be making enough server side requests, on behalf of multiple users, that you run up against Twitter’s API Rate Limiting. (Having multiple auth-tokens will allow for a higher API rate)
    2. You need to automagically send tweets and/or follow accounts on the user’s behalf
      N.B. do this as opt-in and be ultra clear about when/why you will be doing this, or you will face the justified fury of scorned users

    Don’t verify the account if you’re looking to do these things:

    1. You need to send tweets and/or follow accounts on the user’s behalf, and the user will be able to perform a browser based confirmation workflow for each of those actions; use Twitter’s Web Intents for this.
    2. If you just want to pull in real time data for user’s avatar, bio, or recent Tweets Twitter supplies some prefab widgets for you.
    3. All of the authenticated Twitter API Calls can be done client side with JavaScript. Twitter has a js framework, which does not require you to handle and store tokens on your server, to help you with that.
    4. An alternate contact method for password resets, notifications, etc.
      Private communication between users on twitter requires mutual following, many users probably never check their Direct Messages (or even know what a DM is), and any messages would be limited to 140 characters. Just use email for all that kind of nonsense.
    5. If you’re just gathering this info to display it on a user’s profile page, in an “other places on the web” kind of way, integrating and maintaining all the server side OAuth pieces is likely too much bother. Just make sure you have a reasonable and clear TOS and an obvious way for 3rd parties to report any of your users who may be claiming a twitter account that is not their own.

    If you’re still interested in OAuth, Twitter’s Dev page has plenty of resources, including a nice overview of a generic “Sign In with Twitter” “3 legged” OAuth work flow.

    • 0