Is OAuth 2.0 with PKCE flow supported?

[antsstyle]

Hi everyone,

Just wondering in case I've missed it - is Twitter's OAuth 2.0 with PKCE flow supported in TwitterOAuth? I can't find mention of it anywhere in the docs, and the methods I can find only seem to support OAuth 1.0a.

Still figuring out exactly how the PKCE flow works with Twitter, sorry if I missed something obvious somewhere!

[abraham]

I believe this will require some work but I haven't had time to look into it yet.

[antsstyle]

Alright. I'm looking into it during the month - if I figure it out, if I have time I'll make a pull request, or if not I'll post my findings here.

[antsstyle]

Writing an update here, have managed to get OAuth2 with PKCE working and making requests successfully. The main pitfalls were getting the authorize URL correct and putting correct scopes on the access tokens.

The example pseudocode here for a Confidential Client app that can keep its client secret secure. I'll try and write a proper explanation and some better code if I get time. Sorry for the not-so-great code quality xD twitteroauth2pkce.zip

[ghnp5]

Hi @abraham . Is this supported now by any chance? Doesn't seem like, but I'd like to confirm with you 😊 Thank you!

[anibalsanchez]

OAuth2 with PKCE for Twitter APIv2 is supported by The PHP League with https://github.com/smolblog/oauth2-twitter

You can use smolblog/oauth2-twitter to generate the Bearer Token and then use it in abraham/twitteroauth.

// Create the Auth provider
$twitterProvider = new Smolblog\OAuth2\Client\Provider\Twitter([
            'clientId'          => $this->clientId,
            'clientSecret'      => $this->clientSecret,
            'redirectUri'       => ....,
        ]);
....
$authUrl = $twitterProvider->getAuthorizationUrl(['scope' => self::SCOPE_PERMISSIONS]);
// Redirect to grant the permissions
...
// Exchange the answered code to the token
$bearerToken = $provider->getAccessToken('authorization_code', [
    'code' => $code,
    'code_verifier' => $oauth2verifier,
]);

....
// Use the bearer token
$twitterOAuth = new Abraham\TwitterOAuth\TwitterOAuth(
            $this->consumerKey,
            $this->consumerSecret,
            null,
            $bearerToken->getToken()
        );

[abraham]

TwitterOAuth is in maintenance mode and major improvements are no longer planned. https://github.com/abraham/twitteroauth/issues/1188