Facebook and Twitter authentication from Mobile Applications

Question

I might be missing something with the Facebook and Twitter logins APIs. Something that is blocking me from understanding how they would be used in mobile applications.

Both APIs seem like they need to redirect you to and then back to a website. How would that work from a mobile app? Or is there another way to use these APIs?

I have to write a website that has native login, Facebook login and Twitter login. Then I am expected to turn around and open up a set of web services to an Android and iPhone mobile apps. Thought this was to "loose" of a question to ask on StackOverflow. What is the best approach? Any links on calling the API without UI interaction?

Answer 1

I've seen apps using social network auth without a hitch. Facebook provides SDKs for Android and iOS. For using Twitter's OAuth API, check out this link.

• tyndall: Can you elaborate on how the phone SDKs work? How does a web OAuth login pass some param/token back to a native mobile app? Do they embed a webkit browser for this handshake? (note: although I have been a web developer for 11 years - I have no real experience in social or mobile so I'm still trying to wrap my head around this)
• sarumont: @tyndall I haven't actually developed any mobile apps using the FB SDK - I just remembered it from using the other API docs. :) I have seen implementations (using Twitter, I think) where it appeared as if there were an equivalent of an iframe in the app for authentication. Given what the Twitter link has to say, you should probably be able to redirect to a URI which will be intercepted by iOS/Android (i.e. myapp://authdone). Sorry I can't be of more help.
• tyndall: No problem... that gives me an idea of what they might use. Thanks + 1

Answer 2

Twitter offers an xAuth API which uses the same tokens as the OAuth one, but uses username/password to fetch them the first time instead of website authentication, so you can avoid the need for the browser. The catch is you need to specifically request access to this API, but it seems like they'll give it to anybody who's got screenshots and a good description of their feature set.

• tyndall: Thanks Justin. This xAuth might be an option for the Twitter part. +1