Develop Reference

How to make 'access_type=offline' / server-only OAuth2 operations on GAE/Python?

This post is a followup to How to do OAuth-requiring operations in a GAE cron job?, where I realized I'm mis-using the #oauth_required decorator from OAuth2DecoratorFromClientSecrets.
As described by the OAuth 2.0 explained presentation, Oauth 2.0 solves the problem of:
Building a service...
... accessed by a user...
... and accessing the user's data from a third party.
That's what #oauth_required abstracts, and it does it well (currently my app "works": if I trigger the refresh page, I'm being asked to authorize access to my youtube data to my app, and the rest follows). But that's not what I want! My app does something simpler, which is creating a youtube playlist every day with my credentials and without any user input. So to compare to the above 3-tier negociation, I want:
A service
... accessed by users
... but only accessing "server-owned" YouTube playlist data. I don't want any access to the user's YouTube data, I just want to modify a playlist I (i.e. me / a userid persisted by the server) own.
But I still need help to do that; here is my current state:
After a few searches I learned that what I want to do is called Offline Access (emphasis mine, which is almost exactly my use case):
"In some cases, your application may need to access a Google API when the user is not present. Examples of this include backup services and applications that make blogger posts exactly at 8am on Monday morning. This style of access is called offline, and web server applications may request offline access from a user. The normal and default style of access is called online."...
→ So I should keep doing what I'm doing right now, keep requesting access to my YouTube account, but do it using the type_access=offline flag to get a token, and persist/use it for subsequent requests.
The Offline Access and Using a Refresh Token sections make total sense, but stay at a general HTTP level. Being still a newbie, I don't see how to integrate those principles into my Python code, and I didn't find any sample Python code around....
→ Could anyone help me with one Python example illustrating how and where to use this flag?
... and in particular, after studying oauth2client.appengine.OAuth2Decorator.oauth_required, I'm still not sure if I can bend it to my case, or if I should do my own thing.
→ What do you think?
Thanks for your time; if needed I'm also hanging out on irc://irc.freenode.net/#appengine as ronj.

Offline access is the default when retrieving tokens; you may have noticed this in the OAuth dialog that comes up:
Perform these operations when I'm not using the application
When your user accepts the OAuth dialog in a method decorated with decorator.oauth_required the credentials for that user will be stored in the datastore, including the refresh token.
Once you have one of these credentials objects, you can use it so authorize an HTTP object for calling APIS:
import httplib2
http = credentials.authorize(httplib2.Http())
and once authorized, it will do all the work for you. So if the access_token is expired, the first API response will be a 401 and so the credentials object will use the refresh_token to get a new access_token and make the request again.
If you know the user ID, you can retrieve the credentials from the datastore as described in How to do OAuth-requiring operations in a GAE Task Queue?:
from oauth2client.appengine import CredentialsModel
from oauth2client.appengine import StorageByKeyName
credentials = StorageByKeyName(
CredentialsModel, user_id, 'credentials').get()
Note/Gotcha:
If a user has already authorized your client ID, the subsequent times you perform OAuth for these users they will not see the OAuth dialog and you won't be given a refresh token. A refresh token can only be given if they go through the OAuth dialog, but since the user had already authorized your client ID, the spec assumes you would already have a refresh token around.
This often comes up when developers are testing OAuth, since they will go through the flow multiple times with a test account and after accepting the 2nd, 3rd, 4th, ... times, they never see the refresh token. A simple way around this is to use approval_prompt=force as an argument to the OAuth2Decorator constructor. This will force the OAuth dialog to appear every time you perform OAuth for a user.
However, this will not cause the dialog to show up every time a request is served for a given user; this would be a TERRIBLE user experience. Instead, the SACSID cookie from the request can be used (by the client library and some App Engine libraries) to determine who the current user is. Once the the library knows that current user, it can get your existing stored token/credentials for that user from the datastore and no jarring dialog will be needed.

Google Apps Python provisioning API & OAuth mess

I'm trying to provision (among other things) groups for our Google Apps domain, using python. I'm also attempting to using OAuth to authorise my application. The API documentation for Python seems to be missing or broken links. But from searching through the code, it seems I can't use the new (GDClient) APIs as (among other things) I can't get a list of group owners (which I can do in the older GDataService API). And the API for group settings seems to be either the old GDataService, or the even newer apiclient API, but I can't perform basic group provisioning using that API. So it seems I'm stuck using the GDataService API. However, I can't get my head around how to use OAuth for GDataService objects - I can create an oauth token using oauth2client, but can't authorise a GDataService object using this token.
Any pointers as to where to go from here? I'm struggling to believe how messy this all is

The provisioning API is still on the older GDataService API. It is being replaced by the new API called directory api (check out here https://developers.google.com/admin-sdk/)
If you just want to at least get start and familiar with the OAuth flow. You should check out this documentation for the Python API client library: https://developers.google.com/api-client-library/python/start/installation
Try the quick start. All you have to do is select the API you want to use, and select the platform (I usually just picked command line). Click 'Configure Project'. Make sure you are already logged in you Google Apps account that you used to create your project in API console. Select your API project and then finally download the whole package.
Remember to replace your client secret file and just run the sample python code. It will do all the OAuth flow for you.

Bypass Twitter OAuth

Essentially the same problem as this question but looking for a solution in Python. How to work around Twitter OAuth?
Ideally, I dont want to have to go through the hoops of setting up a user/login interface and backend since the work I'm doing is for internal purposes.
I would also like to bypass the part where I need to re-direct the user to Twitter for authorization.
Thanks

You'll want to use Twitter's OOB flow. This is explained nicely in this answer
Twitter API - OOB Flow

So, reading between the lines a little, you have a twitter account and a password because this is internal, so you don't want to go with an auth process that requires a user to interact with it?
The idea behind OAuth is that you don't ever find out what the user's password is; I agree that if I'm right about what you are trying to do that it isn't the right thing. The OOB Flow suggested by JohnD has the same problem.
If you do have an account/password, then you can work with submissions to the website directly, using the login form and the tweet form. Unfortunately this means you don't have access to the API (they nuked basic authentication via the API last year) -- depending on what you're trying to do that may or may not be a problem.
Edit:
Use OAuth and remember the token. It never expires, according to the twitter API docs, and since you presumably have some limited number of accounts that you care about, you can just jump through the OAuth hoops once for each account and you're done until you need another account. You can even do the whole thing programmatically given the username and password, assuming they don't stick a captcha in there at some point. But I suspect your best bet is to just use OAuth and store the tokens.

I just found this bash script that works, tested personally, just change --ssl to --sslv3.
It's based on a simpler auth method used on mobile.twitter.com, you can use the same principle to deal with it using urllib2 and re modules.
Otherwise you can consider to lean against a site like http://www.supertweet.net/
SuperTweet.net provides a safe
mechanism to use Basic Authentication
with the Twitter API in your scripts
and other Twitter apps. Simply Sign-up
via Twitter to authorize the MyAuth
API Proxy SuperTweet.net Application
and then assign a password of your
choosing (not your real Twitter
password) that your applications can
use with the http://api.supertweet.net
API.
edit: I see now this site was cited in an article linked in an answer of How to work around Twitter OAuth?, if you already read about it ignore this part.

If you're using a desktop or mobile application, then you can use xAuth. From the user perspective it's the same as basic auth for getting the original OAuth credentials, and there's no going to external pages. Note you have to be approved by the Twitter API team to get xAuth access.

You might consider looking at Mechanize. It automates browser activity.
So you could give your username/password to your script. Then the script should pass on those credentials to http://twitter.com/#!/login.
conventionally, if you manually login from that webpage, the response will be another page based on whether the credentials you used were correct.
Same thing here: Based on whether the credentials are correct, the response is another page.
You can then check whether the response is a "login failed" page or a "login passed" page, and do what you need to do from there.
Hope this helps

How do your set the twitter byline from an application?

Twitter allows applications to set a "byline" that appears after the tweeter's name, but I don't see how to set that. I'm currently using the Python API tweepy. Any ideas?

How do I get “from [MyApp]” appended to updates sent from my API application?
We now recommend developers use OAuth
to perform authentication with the
API. When applications use OAuth,
Twitter automatically knows the source
of status updates. We are therefore
able to append source attribution
(from "[MyApp]") to tweets. If you
would like tweets from your
application to receive a source
parameter, please register an
application and implement OAuth
authentication. We will automatically
include your application as the source
for any tweets sent from your
application.
We originally allowed applications to
create a source parameter for
non-OAuth use but that has been
discontinued. Applications pre-OAuth
source parameters will remain active,
but new registrations are no longer
accepted.
This FAQ tells you everything.

What's the easiest way to get my facebook status and photos using python?

I just want to import my facebook status and photos to my personal django website but all the examples and documentation i can find are for developing facebook applications.
A simple rss feed would be enough but it doesnt seem to exist in facebook.
Do i really have to create a full facebook app to do this?

A simple facebook application isn't that hard ... excluding trying to decipher the soup on developers.facebook.com.
The "problem" is that you need to get an application key, application secret, and sometimes a session key in order to access the web services. Unless someone is sharing a service to do just that (I haven't looked, and you'd need to trust them) then the only way to fulfill the requirements are to create an application. However, the application key/application secret don't actually require that you write anything. They will show up in the Facebook Developer Application (the application that allows you to edit your applications...)
Now, all you need is a session key (however, a session key is not always required, see the Understanding Sessions link below) -- and hopefully a permanent one. To do this, ask for the extended offline_access permission**. If you grant that to an application then it can get a session for you whenever it feels like it (or rather, the session does not follow the one-hour expiration policies for that application). Extended permissions. Understanding Sessions. Oh, but ignore that 'auth.renewOfflineSession(UID)' example -- the method doesn't exist. I told you the "developer" documentation was soup :-)
You can use the URL in format:
http://www.facebook.com/tos.php?api_key=YOURAPIKEY&req_perms=offline_access to request the permission of yourself. Now see the links below :-)
Extra information in:
**I'm not entirely sure if new changes to the FB policy affect forever-sessions, but this link seems more than relevant to the task at hand:
http://blog.jylin.com/2009/10/01/loading-wall-posts-using-facebookstream_get/
Getting offline_access to work with Facebook
Facebook offline access step-by-step
(You need never post/share your facebook application -- you can keep it in sandbox mode forever.)

Probably. Anything that bypassed authentication would be a fairly large privacy issue.

With the release of the new graph api, this is pretty simple once you get your oauth token. Unfortunately you will need to create an app, but it can be a rather small one to get your oauth token so facebook can authorize your requests. You can use the python sdk here: http://github.com/facebook/python-sdk/
Once you have your token, you make a call to: https://graph.facebook.com/[your profile]/statuses?token=[your token]
And you will get json back.
If you first login to facebook and then go to the documentation page you can see the working example by clicking on the statuses link in the connections table.
http://developers.facebook.com/docs/reference/api/user