(net oauth) - OAuth library

This section describes the APIs for OAuth. OAuth is new secure authentication method for web service. For more detail, see OAuth Community Site.

The following example shows how to obtain an access token from Twitter.

(import (rnrs) (net oauth) (sagittarius control) (srfi :13 strings))
;; obtain a request token.
;; type consumer key and secret you have got issued by Twitter
(define token (obtain-request-token
	       "http://api.twitter.com/oauth/request_token"
	       (make-consumer-token
		:key "consumer key"
		:secret "consumer secret")))

(define (get-pin url)
  (print "Open the following url and type in the shown PIN.")
  (print url)
  (let loop ()
    (display "Input PIN: ") (flush-output-port (current-output-port))
    (let1 pin (get-line (current-input-port))
      (cond ((eof-object? pin) #f)
            ((string-null? pin) (loop))
            (else pin)))))

(define (report token)
  (print "(begin")
  (print " (define consumer-key \"" (token-key (token-consumer token)) "\")")
  (print " (define consumer-secret \""
	 (token-secret (token-consumer token))"\")")
  (print " (define access-token \""(token-key token)"\")")
  (print " (define access-token-secret \""(token-secret token)"\")")
  (print ")"))

(define (main args)
  (let1 pin (get-pin (make-authorization-uri
		      "http://api.twitter.com/oauth/authorize"
		      token))
    ;; authorize the request token manually.
    (authorize-request-token token pin)
    ;; obtain the access token
    (let1 access-token (obtain-access-token 
			"http://api.twitter.com/oauth/access_token"
			token)
      (report access-token))))

Now you get the access token to tweet, let's tweet something on Sagittarius:

(import (rnrs) (srfi :26 cut) (text sxml ssax) (net oauth) (sagittarius io))
(define consumer-key "your consumer key")
(define consumer-secret "your consumer secret")
(define access-token "your access token")
(define access-token-secret "your access token secret")

;; creates an access token to tweet.
(define access-token
  (make-access-token :key access-token
		     :secret access-token-secret
		     :consumer
		     (make-consumer-token
		      :key consumer-key
		      :secret consumer-secret)))

(define (call/twitter-api->sxml token method path params . opts)
  (define (call)
    (access-protected-resource 
     (string-append "http://api.twitter.com" path)
     token
     :request-method method
     :user-parameters params))
  (define (retrieve body status hint advice)
    (if hint (print hint))
    (if advice (print advice))
    (call-with-input-string body (cut ssax:xml->sxml <> '())))
  (call-with-values call retrieve))

(define (twitter-update/sxml token message . opts)
  (call/twitter-api->sxml 
   token 'POST "/1/statuses/update.xml" 
   `(("status" ,message))))

;; if you want to use this from command line.
(import (getopt))

(define (main args)
  (with-args args
      ((message (#\m "message") #t (usage)))
    (print (twitter-update/sxml access-token message))))

The examples explain basic flows. To obtain an access token, and access to protected resource with it.

This library provides OAuth 1.0 procedures. The API's names are compatible with cl-oauth.

_ (timestamp (time-second (current-time))) (auth-location :header) _ _ (request-method 'POST) (callback-uri #f) (additional-headers '()) _ _ (signature-method :hmac-sha1) (error-translator default-message-translator)

uri must be string and URI format.

consumer-token must be a consumer token object.

Obtains request token from given uri with given consumer token.

if the keyword arguments are specified:

version specifies which version uses. We only support 1.0 so this must not be specified.

user-parameters is an alist of the extra parameters to be sent to the server. This parameters are in the body message if the request-method is POST or query string if the request-method is GET.

timestamp specifies timestamp to send to the server.

auth-location specifies the place where the authentication information located. This can be either :header or :parameters.

request-method specifies which request method is used. This can be either GET or POST. POST is recommended.

callback-uri specifies call back uri described in OAuth specification. If users don't use specific location to be redirected, this must not be specified.

additional-headers is alist of additional header to be sent to the server.

signature-method specifies which hash method is used. For now we only support :hmac-sha1.

error-translator specifies how to treat the error message sent by the server when error occurred. This must be a procedure which accepts 3 arguments, http status, headers and body respectively.

_ (user-parameters '())

uri must be string and URI format.

request-token must be a request token retrieved by the procedure obtain-request-token.

Creates a authorization URI which user must agree.

The other keyword arguments are the same as obtain-request-token.

request-token must be a request token which retrieved by the procedure obtain-request-token.

verificateion-code must be a string returned by the URI generated by the procedure make-authorization-uriSets the given verificateion-code to the request token and authorized flag #t, manually.

_ (version :1.0) (user-parameters '()) _ _ (timestamp (time-second (current-time))) (auth-location :header) _ _ (request-method 'POST) (callback-uri #f) (additional-headers '()) _ _ (signature-method :hmac-sha1) (error-translator default-message-translator)

uri must a string URI formatted.

token must be either request token or access token.

Obtains access token from the given URI.

The keyword arguments consumer-token specifies which consumer token is used. And must the same one as when you request the request token.

The rest keyword arguments are the same as obtain-request-token.

_ (on-refresh #f) _ _ (version :1.0) (user-parameters '()) _ _ (timestamp (time-second (current-time))) (auth-location :header) _ _ (request-method 'POST) (callback-uri #f) (additional-headers '()) _ _ (signature-method :hmac-sha1) (error-translator default-message-translator)

uri must a string URI formatted.

access-token must be an access token which obtained by the procedure obtain-access-token or created by make-access-token.

Accesses to protected resource.

The keyword argument on-refresh is a hook for when token is expired and refreshed. It must accept be a procedure which accepts 1 argument that is a refreshed access token.

The rest keyword arguments are the same as the obtain-request-token.

Encodes given URI and make it OAuth required form.

Composes given alist to http query form and make it OAuth required form.

_ (last-timestamp 0)

Creates a consumer token.

_ consumer (session-handle #f) (expires #f) (authorization-expires #f) _ _ (origin-uri #f)

Creates a access token.

token must be an access token or request token.

Retrieves consumer token from given token.