Unauthorized when attempting to post tweet api v1 (C#)

Question

Morning all,

I've not posted on SO for quite some time, but I need to ask the question, I’ve spent a day and a half trying to get this to work - it’s super frustrating considering I managed to implement v2 with posting a tweet in 2 - 3 hours but because I need the media endpoint (does not exist in v2), I rebuilt my flow into v1 to upload media.

Ok, so my app allows the user to authenticate with twitter and tweet/upload media. I’m using (I think) the 3-legged oauth flow.

Currently, the flow is :

• https://api.twitter.com/oauth/request_token - 200 status code and I confirm the callback URL
• I use the access token from step 1, and then call/redirect https://api.twitter.com/oauth/authorize?oauth_token={accessToken} this obviously redirects to my endpoint.
• I extract the oauthToken and oauthVerifier and call: https://api.twitter.com/oauth/access_token, this returns an oauthToken and oauthTokenSecret, I store the values.

All of the above conforms to what is in the docs, but when I use the stored values from step 3 to post a tweet I get unauthorized.

The signing logic works because it’s what’s used in “Request access token” - with a couple of changes.

I'm learning more towards a flow issue due to trying various nuget packages(tweetinvi in particular) and I get exceptions in those too.

Any help is greatly appreciated.

Answer 1

Not really an answer per-se, but rather notable actions.

At this point in time, you cannot upload media with V2 of the API, whilst you can integrate quite quickly and send a tweet, it's almost pointless without media.

So, you'll need to build/integrate with V1.

The unknowns and curve balls:

• The most important! V1 requires elevated access! Which you'll need to apply for, not all get accepted! but V2 just integrate and tweet with no elevated access - very strange.
• Always ensure to read the resp correctly, and try few times in code, postman, fiddler etc. Whilst the resp contains a collection of errors object, you'll never get a collection of errors.
• If you're not using any sort of package/library, pay close attention to crafting the request signature - it's a pain.