Twitter API与OAuth技术问题：如何复用用户访问令牌实现后续请求？

Great question—you absolutely can save and reuse a user's Twitter access token to make subsequent requests without requiring them to log in every time. Twitter's OAuth 1.0a flow (which you're using here) issues long-lived access tokens that remain valid unless the user revokes your app's permissions, or you reset your app's Consumer Key/Secret.

To make future API calls on behalf of the user, you need to persist these two core values from the $access_token array you get after authentication:

• oauth_token: The user's access token
• oauth_token_secret: The corresponding secret key for the token

It's also helpful to save the user's user_id and screen_name (also included in the $access_token response) to link the Twitter credentials to your system's user account, and avoid redundant calls to account/verify_credentials.

Your current code only retrieves the access token in the callback page but doesn't store it permanently—that's why you can't make requests from other pages. Here's how to adjust your workflow:

1. Callback Page: Retrieve and Save the Access Token #

require "autoload.php";
use Abraham\TwitterOAuth\TwitterOAuth;

define('CONSUMER_KEY', 'your-consumer-key');
define('CONSUMER_SECRET', 'your-consumer-secret');
define('OAUTH_CALLBACK', 'https://your-domain.com/API/Twitter/Twitter.php');

session_start();

// Handle Twitter's callback response
if (isset($_GET['oauth_verifier'], $_GET['oauth_token']) && isset($_SESSION['oauth_token_secret'])) {
    // Create a connection with temporary credentials
    $connection = new TwitterOAuth(CONSUMER_KEY, CONSUMER_SECRET, $_SESSION['oauth_token'], $_SESSION['oauth_token_secret']);
    
    // Exchange temporary credentials for a long-lived access token
    $access_token = $connection->oauth('oauth/access_token', [
        "oauth_verifier" => $_GET['oauth_verifier'],
        'oauth_token' => $_GET['oauth_token']
    ]);

    // 🔑 Critical Step: Save the token data to your database (link to your system's user)
    // Example pseudocode:
    // $yourSystemUserId = $_SESSION['current_user_id']; // Replace with your app's user ID
    // $db->query("UPDATE users SET twitter_token = ?, twitter_token_secret = ?, twitter_user_id = ?, twitter_screen_name = ? WHERE id = ?", [
    //     $access_token['oauth_token'],
    //     $access_token['oauth_token_secret'],
    //     $access_token['user_id'],
    //     $access_token['screen_name'],
    //     $yourSystemUserId
    // ]);

    // Optional: Fetch user data immediately after authentication
    $connection = new TwitterOAuth(CONSUMER_KEY, CONSUMER_SECRET, $access_token['oauth_token'], $access_token['oauth_token_secret']);
    $userProfile = $connection->get('account/verify_credentials');
    $userTimeline = $connection->get("statuses/user_timeline", ["screen_name"=>$userProfile->screen_name, "count"=>10]);

    // Clean up temporary credentials from the session
    unset($_SESSION['oauth_token'], $_SESSION['oauth_token_secret']);
} else {
    // Redirect user to Twitter's authentication page
    $connection = new TwitterOAuth(CONSUMER_KEY, CONSUMER_SECRET);
    $temporary_credentials = $connection->oauth('oauth/request_token', ["oauth_callback" => OAUTH_CALLBACK]);
    
    $_SESSION['oauth_token'] = $temporary_credentials['oauth_token'];
    $_SESSION['oauth_token_secret'] = $temporary_credentials['oauth_token_secret'];
    
    $authUrl = $connection->url('oauth/authenticate', ['oauth_token' => $temporary_credentials['oauth_token']]);
    header("Location: $authUrl");
    exit;
}

2. Other Pages: Reuse the Saved Token for Requests #

On any page where you need to call the Twitter API, just fetch the saved token from your database and create a new connection:

require "autoload.php";
use Abraham\TwitterOAuth\TwitterOAuth;

define('CONSUMER_KEY', 'your-consumer-key');
define('CONSUMER_SECRET', 'your-consumer-secret');

// Fetch the user's saved Twitter credentials from your database
// Example pseudocode:
// $yourSystemUserId = $_SESSION['current_user_id'];
// $userTwitterData = $db->query("SELECT twitter_token, twitter_token_secret FROM users WHERE id = ?", [$yourSystemUserId])->fetch();

$savedToken = $userTwitterData['twitter_token'];
$savedTokenSecret = $userTwitterData['twitter_token_secret'];

// Create an API connection with the saved credentials
$connection = new TwitterOAuth(CONSUMER_KEY, CONSUMER_SECRET, $savedToken, $savedTokenSecret);

// Make any authorized API request
$latestTweets = $connection->get("statuses/user_timeline", ["count" => 5]);
print_r($latestTweets);

• Secure Storage: Never store access tokens or secrets in client-side storage (like cookies). Always keep them on your server, and consider encrypting sensitive fields in your database.
• Handling Expiration: Tokens will become invalid if the user revokes your app's access, or if you reset your app's Consumer Key/Secret. Catch API errors (like 401 Unauthorized) and redirect users to re-authenticate when this happens.
• Permission Scope: Ensure your app requested the necessary permissions during setup (e.g., read access for tweets, write access for posting) to support the API calls you plan to make.

内容的提问来源于stack exchange，提问作者MattOlivos