Question

This seems like a simple question, but I can’t find a simple explanation anywhere. I’m sure I’m just searching for the wrong thing, so please bear with me…

If I use the Twitter REST API (for example) and I use OAuth to authenticate the user, how do I verify to Twitter that I have the appropriate credentials when sending API requests after the initial authentication? Am I supposed to submit the AuthToken (via GET/POST variables) each time I want to communicate with the API? Seems simple, but there are no “optional” authentication parameters in the Twitter API for the methods.

Update:

Since I’m using PHP to access the Twitter API, I stumbled upon this code:

$connection = getConnectionWithAccessToken("abcdefg", "hijklmnop");
$content = $connection->get("statuses/home_timeline");

Does this mean that you simply authenticate every time you want to access the API?

For example:

In index.php:
    1. authenticate
    2. access desired API methods
    3. Finish loading page

User navigates to page2.php

In page2.php:
    1. authenticate...again
    2. access desired API methods...again
    3. Finish loading page

User navigates to page3.php

In page3.php:
    1. authenticate...again!
    2. access desired API methods...again
    3. Finish loading page

This seems frustratingly repetitive to authenticate every single time like this, but it seems like it is necessary. Does the above explain the gist of OAuth (more importantly, authentication in general)?

Answer 1

OAuth protocol uses access_token like Session ID, when your user has already authorized to your site, you can use access_token that API server gives you to access their API.

So, technically you are not authenticating with every request, Twitter only uses a “SessionID” to identify your further requests.