4

I am developing an app that will use the Twitter and Facebook login APIs exclusively.

Suppose a new user downloads the apps and is presented with the option to log in through Facebook or Twitter. The user chooses Facebook.

I think the procedure at this point is to

a) create an auto-generated user ID in my Users table
b) store the Facebook credentials against the auto-generated user ID

I am confused about part b. Does Facebook return a unique ID when their API is called that I can store against my user ID or is there some alternate process? In other words, what exactly does it mean to store the Facebook credentials?

zgall1
  • 343
  • 1
  • 3
  • 7
  • 2
    What documentation have you read about the authorization process? What part of it did you not understand? – Adam Zuckerman Mar 27 '14 at 16:54
  • I read this - https://developers.facebook.com/docs/ios/login-tutorial/ - but I could not find where it explicitly mentioned the problem I am trying to understand. – zgall1 Mar 27 '14 at 17:47
  • @AdamZuckerman Do you need any more information from me? I'm happy to provide it. – zgall1 Mar 28 '14 at 15:01
  • 1
    It against the Terms of Service for you to capture the users credentials much less store them. Instead the user authenticates directly with Facebook or Twitter and authorizes them to give you a token that allows access to the Facebook or Twitter data you want. – Pete Apr 26 '14 at 19:54

1 Answers1

2

You're talking about OAuth I imagine... specifically 3 legged

https://dev.twitter.com/docs/auth/3-legged-authorization

Overview

The 3-legged OAuth flow allows your application to obtain an access token by redirecting a user to Twitter and having them authorize your application. This flow is almost identical to the flow described in Implementing Sign in with Twitter, with two exceptions:

The GET oauth/authorize endpoint is used instead of /oauth/authenticate The user will always be prompted to authorize access to your application, even if access was previously granted.

b) store the Facebook credentials against the access token

I am confused about part b. Does Facebook return a unique ID when their API is called that I can store against my user ID or is there some alternate process? In other words, what exactly does it mean to store the Facebook credentials?

You're storing the access token provided by Twitter

you still will have your own user table if your application requires it.

Erik
  • 361
  • 1
  • 7