# OAuth Help **URL:** \ **Category:** Dev/API Corner\ **Tags:** plugin-dev\ **Created:** [January 5, 2011, 7:19pm UTC](https://forums.plex.tv/t/oauth-help/7226 "2011-01-05T19:19:02Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![IanDBird](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/iandbird/32/85993_2.png) [@IanDBird](https://forums.plex.tv/u/IanDBird)\ **Post date:** [January 5, 2011, 7:19pm UTC](https://forums.plex.tv/t/oauth-help/7226/1 "2011-01-05T19:19:02Z")
I’m attempting to get a LoveFilm plugin developed and stumbling around with OAuth. I’m attempting to use the public API provided by LoveFilm and have been given a API key for the application. However, LoveFilm uses OAuth in order to authenticate the user so that the user does not need to provide the application with their user name and password. As far as I can work out, the process is as follows: [list] [_]Make a POST request to [http://openapi.lovefilm.com/oauth/request\_token](http://openapi.lovefilm.com/oauth/request_token). I can either set oauth\_callback to a URL that the browser will redirect too once authorised (not appropriate), or “oob” which means the user needs to manually enter the authorisation token once authorised._ _[_]The server will respond specifying an oauth\_token and a login\_url. The user is required to enter the oauth\_token into the login\_url. [_]Once the user’s done this, they are given a 6 digit verification code which they are prompted to enter into the application_ _[_]Make a POST request to [http://openapi.lovefilm.com/oauth/access\_token](http://openapi.lovefilm.com/oauth/access_token). The oauth\_verifier should be set to the 6 digit verification code given to the user [_]The server then responds with a new oauth\_token and oauth\_token\_secret which should be stored by the application._ _[_]Any future calls to the server is required to specify the oauth\_token and oauth\_token\_secret [/list] The initial oauth\_token and verification code only last for a few minutes. I’m trying to work out the best way to do this within Plex. It seems a bit of a pain for the user to have to go through this process, jumping from the application to a browser and then back again; and they have to do all this in a couple of minutes. Has anyone come across anything like this before? Any suggestions or example plugins which need to do something similar? Any help would be greatly appreciated. ---
**Author:** ![sansnipple](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sansnipple](https://forums.plex.tv/u/sansnipple)\ **Post date:** [January 6, 2011, 4:56am UTC](https://forums.plex.tv/t/oauth-help/7226/2 "2011-01-06T04:56:06Z")
pretty sure the netflix plugin uses OAuth ---
**Author:** ![IanDBird](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/iandbird/32/85993_2.png) [@IanDBird](https://forums.plex.tv/u/IanDBird)\ **Post date:** [January 6, 2011, 5:42pm UTC](https://forums.plex.tv/t/oauth-help/7226/3 "2011-01-06T17:42:30Z")
Yeah, i’ve had a look at the Netflix plugin. Unfortunately, im not able to give it a go, since i’m in the UK, hence LoveFilm 🙂 It appears that the plugin attempts to programmatically drive the user’s authentication and activation of the OAuth application. This is of course possible but kinda side stepping the issue. I was hoping for something more sustainable since this will break whenever the website changes (or maybe different between UK, German, etc). However, I guess for now i’ll go down this line. Once it’s done, i’ll also make all the code (with commenting :)) available on GitHub so that others can fix if it becomes broken and i’m not around to resolve it. ---
**Author:** ![jwray](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/jwray/32/99832_2.png) [@jwray](https://forums.plex.tv/u/jwray)\ **Post date:** [January 7, 2011, 3:31am UTC](https://forums.plex.tv/t/oauth-help/7226/4 "2011-01-07T03:31:36Z")
I’m interested in this topic also. It came up for me a couple of times recently and I solved the problem by ignoring it and limiting functionality. I’ll see if I can catch one of the core developers over the weekend and ask if they have any thoughts or plans for better support. Knowing nothing about OAuth certainly hinders me in thinking about what’s possible. Jonny ---
**Author:** ![IanDBird](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/iandbird/32/85993_2.png) [@IanDBird](https://forums.plex.tv/u/IanDBird)\ **Post date:** [January 7, 2011, 9:02am UTC](https://forums.plex.tv/t/oauth-help/7226/5 "2011-01-07T09:02:43Z")
Yeah, it does sound that if it’s going to become frequently ran into, it would be nice to get some framework support; or even some “best practices” guidelines. ---
**Author:** ![pierre1313](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/pierre1313/32/523_2.png) [@pierre1313](https://forums.plex.tv/u/pierre1313)\ **Post date:** [January 12, 2011, 11:45pm UTC](https://forums.plex.tv/t/oauth-help/7226/6 "2011-01-12T23:45:36Z")
just for educational purposes here is a link to the youtube API page with a good doc on OAuth: [http://code.google.com/apis/youtube/2.0/developers\_guide\_protocol\_oauth.html#OAuth\_Authentication](http://code.google.com/apis/youtube/2.0/developers_guide_protocol_oauth.html#OAuth_Authentication) good luck ---
**Author:** ![thedamner](https://avatars.discourse-cdn.com/v4/letter/t/58f4c7/32.png) [@thedamner](https://forums.plex.tv/u/thedamner)\ **Post date:** [January 13, 2011, 10:30pm UTC](https://forums.plex.tv/t/oauth-help/7226/7 "2011-01-13T22:30:26Z")
Here is an OAuth implementation I wrote in Ruby. While that won’t be entirely helpful the algorithm works just fine for OAuth. This was meant as an executable from the commandline and returns a valid URL for me to query. Anyway…the only other thing to worry about besides calculating the correct keys is to _alphabetize_ the parameters before encoding them. Good luck. ```auto
%w{openssl base64 cgi uri digest/md5 hmac/sha1 }.each { |x| require x}

class Symbol
include Comparable

def <=>(other)
self.to_s <=> other.to_s
end
end

def make_url(url, terms)
epoch_micro, epoch_full = Time.now.to_f, Time.now.to_i

shared_secret = 'SHAREDSECRET&' #don't forget the ampersand

options = {
:oauth_consumer_key => 'WHATEVERYOURKEYIS',
:oauth_nonce => Digest::MD5.hexdigest( rand( (epoch_full - epoch_micro + 1) + epoch_micro ).to_s ),
:oauth_signature_method => 'HMAC-SHA1',
:oauth_timestamp => epoch_full,
:oauth_version => '1.0'
}

full_options = options.sort.collect{|key, val| "#{key}=#{val}"} * "&"

terms = URI.escape(terms)

base_sig = 'GET&' + CGI.escape(url) + "&" + CGI.escape(full_options) + CGI.escape('&term=' + terms)

signed = Base64.encode64(HMAC::SHA1.digest(shared_secret, base_sig)).chomp

puts url + '?' + full_options + '&term=' + terms + '&oauth_signature=' + CGI.escape(signed)

end

make_url(ARGV[0], ARGV[1])
``` ---
**Author:** ![sansnipple](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sansnipple](https://forums.plex.tv/u/sansnipple)\ **Post date:** [January 14, 2011, 12:22am UTC](https://forums.plex.tv/t/oauth-help/7226/8 "2011-01-14T00:22:22Z")
there are plenty of existing mature oauth libraries out there. reimplementing the wheel not required. [http://oauth.net/code/](http://oauth.net/code/) [http://code.google.com/p/oauth/](http://code.google.com/p/oauth/) [https://github.com/simplegeo/python-oauth2](https://github.com/simplegeo/python-oauth2) ---
**Author:** ![system](https://global.discourse-cdn.com/plex/original/3X/2/a/2acb9765406f63293d357b4ec509ec39aa28f2ad.png) [@system](https://forums.plex.tv/u/system)\ **Post date:** [December 20, 2019, 8:56pm UTC](https://forums.plex.tv/t/oauth-help/7226/9 "2019-12-20T20:56:37Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.