Refresh Token for OAuth 2.0 PKCE #1912

markusspitzli · 2022-06-11T05:15:37Z

markusspitzli
Jun 11, 2022

hi

I'm using the OAuth2UserHandler for getting the token. It works fine for 2 hours, but then I have to manually approve my app again. I rather want that my script refreshes the token automatically. How would you achieve that?

My code so far:

oauth2_user_handler = tweepy.OAuth2UserHandler(
    client_id=cMYCLIENTID,
    client_secret=MYCLIENTSECRET,
    redirect_uri=MYURL,
    scope=["tweet.read", "tweet.write", "users.read", "follows.read", "follows.write", "like.read", "like.write","offline.access"],
)

print(oauth2_user_handler.get_authorization_url())
authorization_response = input("Enter Auth URL: ")

token =  oauth2_user_handler.fetch_token(authorization_response)

twitter_client = tweepy.Client(token["access_token"], wait_on_rate_limit=True)

turkishmaid · 2022-10-10T05:05:42Z

turkishmaid
Oct 10, 2022

Because PR #1806 is not being merged for a very long time, you can implement the following workaround in your code to avoid forking whole tweepy and implement the PR in your fork:

You will need to store the token somewhere locally to reuse it again later. Store the full token you got from the authorization_response above, not only the access_token field. Your scope list already contains offline.access.
Extend tweepy.OAuth2UserHandler with code from the PR:

import tweepy

class MyOAuth2UserHandler(tweepy.OAuth2UserHandler):
    # Kudos https://github.com/tweepy/tweepy/pull/1806

    def refresh_token(self, refresh_token): 
        new_token = super().refresh_token(
                "https://api.twitter.com/2/oauth2/token",
                refresh_token=refresh_token,
                body=f"grant_type=refresh_token&client_id={self.client_id}",
            )
        return new_token

Replace of your current manual authorization handshake to use the new class instead, like so:

# ... get old_token from your local storage ...

auth = MyOAuth2UserHandler(
    client_id=MYCLIENTID,  # same credentials as used before
    client_secret= MYCLIENTSECRET,
    redirect_uri=MYURL,
    scope=[..., "offline.access"],
)

new_token = auth.refresh_token(old_token["refresh_token"])

# ... replace old_token by new_token in your local storage ...

Your local storage should ...commonplace security considerations...

Worked fine for me.

Alternative approach would be to nudge the maintainers to merge the PR 😇

2 replies

matt-cloud-ai Oct 23, 2024

Very helpful, to add one more thing, you need to set basic auth as headers:

from requests.auth import HTTPBasicAuth

class MyOAuth2UserHandler(tweepy.OAuth2UserHandler):
# Kudos #1806

def refresh_token(self, refresh_token): 
    new_token = super().refresh_token(
            "https://api.twitter.com/2/oauth2/token",
            refresh_token=refresh_token,
            auth=HTTPBasicAuth(CLIENT_ID, CLIENT_SECRET),
            body=f"grant_type=refresh_token&client_id={CLIENT_ID}",
        )
    return new_token

adrienthiery Oct 30, 2024

To leverage the max of the tweepy logic, you can probably just use: auth=self.auth (see

tweepy/tweepy/auth.py

Line 199 in 91a41c6

self.auth = HTTPBasicAuth(client_id, client_secret)

), no ?

Navigation Menu

Uh oh!

Uh oh!

Refresh Token for OAuth 2.0 PKCE #1912

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Uh oh!

Refresh Token for OAuth 2.0 PKCE #1912

Uh oh!

markusspitzli Jun 11, 2022

Replies: 1 comment · 2 replies

Uh oh!

Uh oh!

turkishmaid Oct 10, 2022

Uh oh!

matt-cloud-ai Oct 23, 2024

Uh oh!

adrienthiery Oct 30, 2024

markusspitzli
Jun 11, 2022

Replies: 1 comment 2 replies

turkishmaid
Oct 10, 2022