Skip to content

Commit 7743e58

Browse files
committed
doc: Add OAuth2 example documentation
1 parent 2954f7b commit 7743e58

2 files changed

Lines changed: 22 additions & 4 deletions

File tree

doc/auth.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -246,17 +246,17 @@ app.get('/callback', (req, res) => {
246246
The `.loginWithOAuth2()` method already returns a logged client, but if you want to create an instance by yourself with an access token (for example to use your refresh token), use it as a **Bearer token**.
247247

248248
```ts
249-
const client = new TwitterApi('<YOUR_ACCESS_TOKEN>');
249+
const client = new TwitterApi('<YOUR-ACCESS-TOKEN>');
250250
```
251251

252252
### Optional: refresh the token later
253253

254254
If you choose to include `'offline.access'` as scope, you can store and re-use later `refreshToken` when `expiresIn` time kicks in.
255255

256256
```ts
257-
// Obtain the couple {accessToken} + {refreshToken} from your DB/store
258-
const client = new TwitterApi(accessToken);
257+
const client = new TwitterApi({ clientId: '<YOUR-CLIENT-ID>', clientSecret: '<YOUR-CLIENT-SECRET>' });
259258

259+
// Obtain the {refreshToken} from your DB/store
260260
const { client: refreshedClient, accessToken, refreshToken: newRefreshToken } = await client.refreshOAuth2Token(refreshToken);
261261

262262
// Store refreshed {accessToken} and {newRefreshToken} to remplace the old ones

doc/examples.md

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,14 @@ For each implemented endpoint, you have a link to documentation available in JSD
1515

1616
### With user credentials (act as a logged user)
1717

18-
This kind of auth is needed for endpoint mentionned with `"OAuth 1.0a User context"` in Twitter documentation.
18+
This kind of auth is needed for endpoint mentionned with `"OAuth 1.0a User context"` or `"OAuth 2.0 Authorization Code with PKCE"` in Twitter documentation.
1919
Usually, this is used to act on behalf of a user.
2020

2121
Access token and access secret are obtained through [the 3-legged auth flow](./auth.md).
2222

23+
- OAuth 1.0a User context
24+
25+
This authentification method requires to use a couple of 4 keys, 2 are your app keys and 2 are obtained with the 3-legged auth flow.
2326
```ts
2427
const client = new TwitterApi({
2528
appKey: '<YOUR-TWITTER-APP-TOKEN>',
@@ -30,6 +33,21 @@ const client = new TwitterApi({
3033
// NOTE: accessToken and accessSecret are not required if you want to generate OAuth login links.
3134
```
3235

36+
- OAuth 2.0 Authorization Code with PKCE
37+
38+
This authentification method only requires to use the obtained **access token** with the 3-legged OAuth2 auth flow.
39+
```ts
40+
const client = new TwitterApi('<YOUR-ACCESS-TOKEN>');
41+
```
42+
43+
If your access token is no longer valid, but your have a refresh token (you specified `offline.access` in scope array), you can ask for a new access token with your client keys:
44+
```ts
45+
const client = new TwitterApi({ clientId: '<YOUR-CLIENT-ID>', clientSecret: '<YOUR-CLIENT-SECRET>' });
46+
const { client: refreshedClient, accessToken, refreshToken } = await client.refreshOAuth2Token('<YOUR-REFRESH-TOKEN>');
47+
48+
// Use {refreshedClient}, and save {accessToken} and {refreshToken} in your storage to use them later
49+
```
50+
3351
### With app-only credentials
3452

3553
This kind of auth is accepted on Twitter endpoints with `"OAuth 2.0 Bearer token"` (or Application context) mentionned in documentation.

0 commit comments

Comments
 (0)