OAuth is cool. It’s safe and secure for the end user. It’s convenient for the developers as well. Basic Auth entirely depends on the username and password of the user. So, the developer can do whatever s/he wishes with the user account as long as the user doesn’t change the password. On the other hand, if the user for some reason changes his/her password, the application will no longer be able to access the account and provide the desired service. OAuth helps both parties here! When the user authenticates an app via OAuth, it provides the developer with an access token ( a key and a secret ) which is by no way related to the user’s password. It’s unique for every user and application pair. That is every user will have an unique access token only for that application. Now even if the user changes the password, the access token will remain unchanged. The developer can safely store the token and use that to access the user’s account without hassle. Similarly, if the user wants to revoke the access permitted to an application, he or she can easily do that. In that case, the access token becomes invalid and the application loses access to that account.

In the Basic Auth age, it was very easy to develop twitter bots. You just setup the username and password into a configuration file, call the REST API with the login details and you’re done! Yeah, it was quite easy. But it’s not harder now Don’t fret, OAuth is also very simple and easy to implement for twitter bots. While you need to go through a two phase OAuth dance to authorize other users, Twitter displays the access token of the developer directly into the dashboard! Thanks to Twitter for making things so plain for developers! With your own access token, you can authorize your apps directly without any further verification.

To get the access token, first go to : http://dev.twitter.com. Login if you’re not already logged in. Use the twitter ID you want to run as a bot. Go to http://dev.twitter.com/apps by clicking the “Your Apps” on top right corner. You will see a list of applications under the logged in twitter account. One big advantage of the basic auth was that you didn’t need to create applications. But now you need! Create an application if you don’t already have one created. In most cases you won’t have one since this is probably the first time you’re using OAuth. In that situation, please create an application. Note down the Consumer Key and Consumer Secret after visiting the application page by clicking on any of the application name. Now, on the right hand navigation bar, you’ll see “My Access Token”. Please visit that section and retrieve your Access Token and Access Token Secret. That’s all we needed. Now let’s do some coding to demonstrate the use of these keys and secrets.

We first need to get a Twitter Client library. If you’re already using one, just check to make sure that it has OAuth support. The work flow is simple. First construct the client with the consumer key and consumer secret. Then set the access token key and the access token secret. Now use the client to make Twitter API calls, in our case, to update statuses!

You can get the OAuth libraries from : http://dev.twitter.com/pages/oauth_libraries . But I recommend using Tweepy with Python and Abraham’s TwitterOAuth with PHP . They are not generic OAuth clients. They were built for Twitter and you don’t need to configure any extra parameters to make it work with Twitter.

Here’s the code samples on how to use the libraries to update status via OAuth.

PHP (Abraham’s TwitterOAuth)

<?php
$consumer_key = "";
$consumer_secret = "";
$access_key = "";
$access_secret = "";
 
require_once('twitteroauth/twitteroauth.php');
 
$connection = new TwitterOAuth ($consumer_key ,$consumer_secret , $access_key , $access_secret );
 
$connection->post('statuses/update', array('status' => "Hello Twitter OAuth!"));
?>

Python (Tweepy)

consumer_key = ""
consumer_secret = ""
access_token = ""
access_token_secret = ""
 
auth = tweepy.OAuthHandler(consumer_key, consumer_secret)
auth.set_access_token(access_token, access_token_secret)
bot = tweepy.API(auth)
 
bot.update_status("Hello Twitter OAuth!")

I am amazed to see the implementation of cron jobs on Google App Engine. I was hosting my twitter bots on my paid shared hosting. My scripts were written in php and they were run via cron jobs set from my cPanel. Of course the cPanel cron UI is now quite familiar to me, to us who use it very often. But as a matter of fact, I can’t run per minute cron on my host. I should have a minimum interval of 15 minutes between two execution of the same cron job. I was amazed when I first discovered that Google App Engine lets me run cron every minute. Since they calculate my usage in different types of quotas, they hardly care about how often you schedule your cron. So, I decided to port my twitter bots to GAE and Python.

The idea was pretty simple. I already had a Yahoo! Pipe setup which mashes up multiple RSS feeds into one. My app will be collecting data from the pipe in JSON format. Then it’ll check the last tweeted entry and tweet the newer entries. Pretty straightforward algorithm. I registered a new application for my bots and started developing it on my local machine.

I integrated the u.nu url shortening service with their API quite easily. Though Python 2.6.2 has a built in module for JSON handling, Python 2.5 doesn’t have it. So, I had to install simplejson for JSON decoding. Later, I moved on to finding a good twitter client for my app. I first tried python-twitter. I have previously used it and it worked fine. But the application was generating some error messages when I integrated into GAE. I was puzzled and tried to find if there was something wrong in my coding. After about an hour, I concluded that my code was okay! There’s something wrong with the client. A bit of googling revealed that “python-twitter” doesn’t work on GAE without any hacks :’(. I had to find an alternative and I chose tweepy for that. It was working fine with the app.

Finally after 3 hours, the app was ready and it’s working! GAE doesn’t permit long execution period for a process, so I had to decrease the amount of tweets per request. But I covered that up by setting a more frequent cron job . I would try the new taskqueue API soon to see if that has any help for my app.

My twitter bots have proved handy in the past and it feels great that I can host them on a scalable and efficient platform like Google App Engine — without paying a single dollar per month!

Download Source : http://masnun.googlecode.com/files/Twitter_BOT_GAE.zip

Here’s the source:

<?php
$topic = $argv[1];
if(empty ($topic)) {
    $topic = "php";
}
$username = "twitter_username";
$password = "twitter_password";
$fp = fopen("http://{$username}:{$password}@stream.twitter.com/1/statuses/filter.json?track={$topic}","r");
while( $data = fgets($fp) ) {
    $tweet = json_decode($data,true);
    if(!empty($tweet['text'])) {
        echo $tweet['user']['screen_name'].": ".$tweet['text']." \n -------------------- \n";
    }
}
?>

Run this script with the keyword as the argument:

php twitter.php keyword

Well, I am going to cover Python for the Twitter streaming API. You need the “tweetstream” python module which depends on the “anyjson” module. Please make sure you have these modules installed before you proceed.

Download Links: anyjson | tweetstream

To install these packages, use the built in setup.py of the individual packages :

sudo python setup.py install

In my case, I didn’t have the “setuptools” python module installed with my default python installation. So I had to install it to get the setup.py work:

sudo apt-get install python-setuptools

I love the magic of debian packages

Now, you can install the modules and dive into our example:

 
#! /usr/bin/env python
 
import tweetstream
 
stream = tweetstream.TweetStream("twitter_username", "twitter_password")
 
for tweet in stream:
    if tweet.has_key("text"):
        print tweet['user']['screen_name'] + ": " + tweet['text'] , "\n"
        print "-----" * 4

That’s it! In real, you get the stream dictionary which you can use to manipulate the tweets.

The “tweetstream” module also lets you access the Track and Follow APIs in a superb fashion!

I love Twitter, I love Python!

1.12.12 25.15.21.18 15 1.18.5 2.5.12.15.14.7 20.15 21.19 was the tweet.

Well, it’s nothing tough. Every number separated by a dot or space corresponds to the alphabet. So, I wrote a PHP script to decode this mysterious tweet and finally found the meaning:

 
masnun@ubuntu:~/Desktop$ php decode-google-tweet
all your o are belong to us
masnun@ubuntu:~/Desktop$

So, it meant ” all your o are belong to us ”
Sounds a bit odd ? Or wrong in grammar ? yeah, still, that’s the message. It is confirmed on the twitpic image.

And here’s the source code –

 
<?php
 
$num = array(); // placeholder for 1 to 26
$alpha = array(); // placeholder for a to z
 
for($i=1;$i<27;$i++) { $num[]= $i; } // dynamically store 1 to 26 in the array
for($i='a';$i<'z';$i++) { $alpha[]= $i; } // dynamically store a to y in the array
$alpha[] = 'z'; // manually add z to the array
$dict = array_combine($num,$alpha); // combine them to form a dictionary
 
// print_r($dict);
 
$string = "1.12.12 25.15.21.18 15 1.18.5 2.5.12.15.14.7 20.15 21.19"; // the code to decode
$arr = explode(" ",$string); // differentiate the parts
 
$meaning = ""; // placeholder for the ultimate meaning
 
for($i=0; $i<count($arr); $i++) {
 
$s = $arr[$i]; // dot seperated portions
$a = explode(".",$s); // seperate the numbers
for($j=0; $j<count($a); $j++) {
$ch = $a[$j]; // get individual numbers
$meaning .= $dict[$ch]; // look up in the dictionary for the corresponding char
 }
$meaning .=" "; // restore the spaces
 
 
}
 
echo $meaning."\n"; // echo the meaning
 
?>

It was quite a bit of fun decoding the message with PHP. Well, I do agree that there was no need to use PHP here. But why do the hard work from memory when you have automation tools at your hand ?

I am not going to include the Twitter OAuth Library source. You have to download it from Github. The link is available in my previous post.

consumer.php

<?php
// Filename: consumer.php
// contains the consumer key and consumer secret
// works as a configuration file that can be included in other
// scripts.
$consumer_key = 'Ll0Sq8HyJzBOqXqksH7N4w';
$consumer_secret = 'WwMdrN13UTJL79KyI6unm3xTm5tdF8E4U3FMKE7i5co';
?>

index.php

<?php
// Filename: index.php
// The file that gets called when you visit the app home page
 
// require twitterOAuth lib
require_once('twitterOAuth.php');
// require the consumer details -- consumer key and consumer secret
require_once('consumer.php');
 
//construct a new twitter object
$twitter = new TwitterOAuth($consumer_key,$consumer_secret);
// get the token to make an authorization request
$token = $twitter->getRequestToken();
// store the token for further use
file_put_contents("token",$token['oauth_token']);
file_put_contents("token_secret",$token['oauth_token_secret']);
// build the authorization url
$url = $twitter->getAuthorizeURL($token['oauth_token']);
// redirect the user to the authorization url automatically
header("Location: $url ");
?>

return.php

<?php
//Filename: return.php
// It's the callback file -- gets called
// the user is returned to this file on authorization
 
// include twitter OAuth library as usual
include('twitterOAuth.php');
// include the consumer details
include('consumer.php');
 
// retrieve the tokens
$tok = file_get_contents("token");
$tok_sec = file_get_contents("token_secret");
 
// construct the twitter object
$twitter = new TwitterOAuth($consumer_key,$consumer_secret,$tok,$tok_sec);
// retrieve the access token set by the authorization
$access_token = $twitter->getAccessToken();
// parse the tokens and seperate them
$tok = $access_token['oauth_token'];
$tok_secret = $access_token['oauth_token_secret'];
 
// print_r($access_token);
// construct the twitter object
// this time with the access tokens
$twitter = new TwitterOAuth($consumer_key,$consumer_secret,$tok,$tok_secret);
// make API call
$req = $twitter ->OAuthRequest('https://twitter.com/statuses/update.xml', array('status' => 'Check out: http://masnun.com/twitter-app/ :)'), 'POST');
 
// print_r($req);
 
//redirect the user to twitter home page
header("Location: http://twitter.com ");
 
?>

Notes On OAuth:
First we, construct the twitter object with the consumer details.
Then we ask for a request token. We build the authorization url with this token.
We send the user to the auth URL.
When the user returns, again construct a twitter object with consumer details and the request token we retrieved previously.
Now that the user is authorized, we ask for access tokens.
We have the access tokens now, so build a new twitter object that has full access to the API.

Now, we can make API calls.

The steps may seem a bit odd at first look. Just go through a couple of times and you’ll get it clearly.

Enjoy OAuthentication, Enjoy Twitter enginnering !!

So, I started studying the Twitter OAuth API and learnt it pretty well. Then I thought what kind of application I could build with this very newly gathered knowledge ? Why not make some fun ? Yeah, I just can’t help making fun every now and then.

Finally, here it is — http://masnun.com/twitter-app/

It’s a little devil app that automatically takes you to the authorization URL and asks for OAuth based authentication. If you allow it, it will automatically make a tweet using your account. The tweet will be nothing bad though, just a link back to the app

To develop this app, I have used the official Twitter OAuth library for PHP written by Abraham. Download it: http://github.com/abraham/twitteroauth .

Points to Ponder:

• An application can do almost anything to your twitter account once you approve it.
• Twitter says, the access token they provide doesn’t expire. That means once you approve an application, it can use your account forever if they are clever enough to store your access token details.
• While approving an application, you never know what kind of permission the application has — read only or read-write both. I think this option should be left upon the users. The users should be able to choose whether he wants to provide write access or not.

I have seen some web sites exploit Twitter accounts. TweeterFollow is a decent example of such nasty practices. Once you provide your credentials, they’ll regularly tweet their links from your account. So think twice before you approve an application though OAuth is safer than providing password since you can choose to withdraw your permission to an application.

I will write detailed about OAuth and provide the source code in another post. Just now, I am feeling extremely sleepy. Woke up to have my Sehri and didn’t return to bed. It’s time I had a nap…

I am quite active on scriptlance and was getting bored with GAF for their very frequent email notification. Finally, I decided to turn off the notifications and deactivate my account. But now that GAF is earning me money from referrals, I am quite happy with them.

The referral links are being spread over the microblogsphere by my twitter bot that collects direct links to available projects on GAF and tweets them. I set up the bot out of experimental purpose but now it looks like it’s gonna be a good money maker as well.

Being inspired by this little surprise , I made some upgrades to the bot. The bot now adds hash sign (#) before important key words to make it search friendly. I also activated a identi.ca and a friendfeed clone of the same bot.

I am thinking of selling this entire bot script at $30. Anyone interested? Bargaining allowed for sure .