3 ms·
And to be pedantic, there's a third step: 3) When you make an authenticated API call, send the access token along with the request, and make sure you're using
by pjscott 15y ago
And to be pedantic, there's a third step:
3) When you make an authenticated API call, send the access token along with the request, and make sure you're using HTTPS.
The HTTPS part is important to give a bunch of the security guarantees than OAuth 1 gives you with plain HTTP and some complicated crypto dancing around.
- andrewmccall 15y agoThe problem with OAuth1 was that the complicated crypto dancing around was exactly that, complicated. Making sure you're using HTTPS is hardly a big ask for developers on either the client or the server and frankly is probably a much better idea given most of these services are more likely than not sending some form of private data.