Question

Looking at Dwolla’s API documentation and trying the oauth.php example code (code shown below) on my site it is not clear to me if I can generate an access token without redirecting to Dwolla’s page.

Redirecting from my site to their site back to my site is really terrible from a UI/UX perspective and is no better than the crappy interface Paypal provides.

Does anyone know how to generate a Dwolla access token using AJAX?

<?php
// Include the Dwolla REST Client
require '../lib/dwolla.php';

// Include any required keys
require '_keys.php';

// OAuth parameters
$redirectUri = 'http://localhost:8888/oauth.php'; // Point back to this file/URL
$permissions = array("Send", "Transactions", "Balance", "Request", "Contacts",   "AccountInfoFull", "Funding");

// Instantiate a new Dwolla REST Client
$Dwolla = new DwollaRestClient($apiKey, $apiSecret, $redirectUri, $permissions);

/**
 * STEP 1: 
 *   Create an authentication URL
 *   that the user will be redirected to
 **/

if(!isset($_GET['code']) && !isset($_GET['error'])) {
$authUrl = $Dwolla->getAuthUrl();
header("Location: {$authUrl}");
}

/**
 * STEP 2:
 *   Exchange the temporary code given
 *   to us in the querystring, for
 *   a never-expiring OAuth access token
 **/
 if(isset($_GET['error'])) {
echo "There was an error. Dwolla said: {$_GET['error_description']}";
}

else if(isset($_GET['code'])) {
$code = $_GET['code'];

$token = $Dwolla->requestToken($code);
if(!$token) { $Dwolla->getError(); } // Check for errors
else {
    session_start();
    $_SESSION['token'] = $token;
    echo "Your access token is: {$token}";
} // Print the access token
}

Answer 1

TL;DR – No, that’s not how OAuth works

---

The whole point of the OAuth scheme is authentication on the website of the service that you want to use, in this case, Dwolla. By forcing the user to go to their page it ensures a few things:

1. The user is made aware that they are using an external service whose terms of service may be different than your application
2. The user is made aware of the features requested by your application for that service. In dwolla’s case there are different levels of functionality that can be requested by your application including transferring of money, so it’s important that your users are aware of that!

You can read up more on OAuth at http://oauth.net/