Package: requests-oauth
# requests-oauthThis plugins adds OAuth v1.0 support to <a href=”https://github.com/kennethreitz”>@kennethreitz</a> well-known <a href=”http://github.com/kennethreitz/requests”>requests</a> library providing both header and url-encoded authentication.requests-oauth wants to provide the simplest and easiest way to do OAuth in Python. It was initially based on <a href=”https://github.com/simplegeo/python-oauth2”>python-oauth2</a> (which looks unmaintained), kudos to the authors and contributors for doing a huge effort in providing OAuth to python httplib2. From that point on, the code base has been cleaned, fixing several bugs and heavily refactoring it to eliminate dependencies with python-oauth2, being now a stand-alone plugin.Author: <a href=”http://www.github.com/maraujop/”>Miguel Araujo</a>Licence: BSD## InstallationYou can install requests-oauth by simply doing:pip install requests-oauth## UsageImport the hook doing:from oauth_hook import OAuthHookYou can initialize the hook passing it 5 parameters:access_token,access_token_secret,consumer_key,consumer_secretandheader_auth. First twoaccess_tokenandaccess_token_secretare optional, in case you want to retrieve those from the API service (see later for an example). There are two ways to do initialize the hook. First one:oauth_hook = OAuthHook(access_token, access_token_secret, consumer_key, consumer_secret, header_auth)Theheader_authparameter lets you chose the authentication method used. It’s a boolean, if you set it toTrueyou will be using an Authorization header. If your API supports this authentication method, it’s the one you should be using and the prefered method by the OAuth spec (<a href=”http://tools.ietf.org/html/rfc5849#section-3.5”>RFC 5849</a>), an example would be Twitter’s API. By defaultheader_authis set toFalse, which means url encoded authentication will be used. This is because this the most widely supported authentication system.If you are using the sameconsumer_keyandconsumer_secretall the time, you probably want to setup those fixed, so that you only have to pass the token parameters for setting the hook:OAuthHook.consumer_key = consumer_key
OAuthHook.consumer_secret = consumer_secret
oauth_hook = OAuthHook(access_token, access_token_secret, header_auth=True)Now you need to pass the hook to python-requests, you probably want to do it as a session, so you don’t have to do this every time:client = requests.session(hooks={‘pre_request’: oauth_hook})What you get is python-requests client which you can use the same way as you use requests API. Let’s see a GET example:response = client.get(’http://api.twitter.com/1/account/rate_limit_status.json’)
results = json.loads(response.content)And a POST example:response = client.post(’http://api.twitter.com/1/statuses/update.json’, {‘status’: “Yay! It works!”, ‘wrap_links’: True})## 3-legged AuthorizationFirst time authorization and authentication follows a system named three legged OAuth, very well described in <a href=”https://dev.twitter.com/docs/auth/implementing-sign-twitter”>Twitter documentation</a>.Basically it is composed of three steps. Let’s see an example based on Imgur’s API. All the other APIs work pretty much the same way, only endpoints (urls) change:#### Step 1: Obtaining a request tokenWe start asking for a request token, which will finally turn into an access token, the one we need to operate on behalf of the user.imgur_oauth_hook = OAuthHook(consumer_key=YOUR_IMGUR_CONSUMER_KEY, consumer_secret=YOUR_IMGUR_CONSUMER_SECRET)
response = requests.post(’http://api.imgur.com/oauth/request_token’, hooks={‘pre_request’: imgur_oauth_hook})
qs = parse_qs(response.text)
oauth_token = qs[‘oauth_token’][0]
oauth_secret = qs[‘oauth_token_secret’][0]#### Step 2: Redirecting the user for getting authorizationIn this step we give the user a link or open a web browser redirecting him to an endpoint, passing theoauth_tokengot in the previous step as a url parameter. The user will get a dialog asking for authorization for our application. In this case we are doing an out of band desktop application, so the user will have to input us a code namedverifier. In web apps, we will get this code as a webhook.print “Go tohttp://api.imgur.com/oauth/authorize?oauth_token=%sallow the app and copy your PIN” % oauth_token
oauth_verifier = raw_input(‘Please enter your PIN:’)#### Step 3: AuthenticateOnce we get user’s authorization, we request a final access token, to operate on behalf of the user. We build a new hook using previous request token information achieved on step1 and pass the verifier (got in step2) as data usingoauth_verifierkey:new_imgur_oauth_hook = OAuthHook(oauth_token, oauth_secret, IMGUR_CONSUMER_KEY, IMGUR_CONSUMER_SECRET)
response = requests.post(’http://api.imgur.com/oauth/access_token’, {‘oauth_verifier’: oauth_verifier}, hooks={‘pre_request’: new_imgur_oauth_hook})
response = parse_qs(response.content)
final_token = response[‘oauth_token’][0]
final_token_secret = response[‘oauth_token_secret’][0]Thesefinal_tokenandfinal_token_secretare the credentials we need to use for handling user’s oauth, so most likely you will want to persist them somehow. These are the ones you should use for building a requests session with a new hook. Beware that not all OAuth APIs provide unlimited time credentials.## TestingIf you want to run the tests, you will need to copytest_settings.py.templateintotest_settings.py. This file is in the.gitignoreindex, so it won’t be committed:cp test_settings.py.template test_settings.pyThen fill in the information there. The testing of the library is done in a functional way, doing GETs and POSTs against public OAuth APIs like Twitter, so use a test account and not your personal account:./tests.py## ContributingIf you’d like to contribute, simply fork the repository, commit your changes to thedevbranch (or branch off of it), and send a pull request. Make sure you add yourself to AUTHORS.