We Keep Coding

Spotify - get and change user data with Implicit Flow

I'm trying to implement a simple python client for Spotify api. According to the Spotify's Authorization Guide, the app can be authorized in two ways:
App Authorization: Spotify authorizes your app to access the Spotify Platform (APIs, SDKs and Widgets).
User Authorization: Spotify, as well as the user, grant your app permission to access and/or modify the user’s own data. For information about User Authentication, see User Authentication with OAuth 2.0. Calls to the Spotify Web API require authorization by your application user. To get that authorization, your application generates a call to the Spotify Accounts Service /authorize endpoint, passing along a list of the scopes for which access permission is sought.
CLIENT CREDENTIALS
My first attempt used the app authorization using the oauth2 module from Spotipy, because it requires no token passed, but only client id and client secret, which belong to the app developer.
client.py
import spotipy
from spotipy.oauth2 import SpotifyClientCredentials
class SpotifyWrapper(spotipy.Spotify):
def category_playlists(self, category, limit=50, offset=0):
return self._get('browse/categories/%s/playlists' % category,
limit=limit,
offset=offset)
def get_api_client():
# create a client authentication request
client_cred = SpotifyClientCredentials(
client_id=DevelopmentConfig.SPOTIFY_CLIENT_ID,
client_secret=DevelopmentConfig.SPOTIFY_CLIENT_SECRET
)
# create a spotify client with a bearer token,
# dynamically re-created if necessary
return SpotifyWrapper(auth=client_cred.get_access_token())
Then I would import and declare it here:
spotify_utilities.py
from app.resources.spotify.client import get_api_client
sp = get_api_client()
And in order to make requests and get user playlists, pass it like so:
def get_user_playlist(username, sp):
ids=[]
playlists = sp.user_playlists(username)
for playlist in playlists['items']:
ids.append(playlist['id'])
print("Name: {}, Number of songs: {}, Playlist ID: {} ".
format(playlist['name'].encode('utf8'),
playlist['tracks']['total'],
playlist['id']))
return ids
This works and will get user content, where the user is the app developer.
IMPLICIT FLOW
Now I want to move on to Implicit Flow, whereby the app asks ANY user who uses for access and scopes, and for that a token will be required.
Once I fetch the token using Javascript, I know I can use it to get user data hitting the API with simple requests:
GET_USER_PROFILE_ENDPOINT = 'https://api.spotify.com/v1/users/{user_id}'
GET_USER_PLAYLISTS_ENDPOINT = 'https://api.spotify.com/v1/users/{user_id}/playlists'
def get_user_profile(token, user_id):
url = GET_USER_PROFILE_ENDPOINT.format(id=user_id)
resp = requests.get(url, headers={"Authorization": "Bearer {}".format(token)})
print (len(resp.json()))
return resp.json()
def get_user_playlists(token, user_id):
url = GET_USER_PLAYLISTS_ENDPOINT..format(id=user_id)
resp = requests.get(url, headers={"Authorization": "Bearer {}".format(token)})
print (len(resp.json()))
return resp.json()
but in order to get (and change) user data first I need to use this token to fetch user ID.
Also, by the following example form Spotipy docs, user must provide his username at terminal:
if __name__ == '__main__':
if len(sys.argv) > 1:
username = sys.argv[1]
else:
print("Whoops, need your username!")
print("usage: python user_playlists.py [username]")
sys.exit()
token = util.prompt_for_user_token(username)
if token:
sp = spotipy.Spotify(auth=token)
playlists = sp.user_playlists(username)
After reading the docs from Spotify and Spotify, some things that are still not clear:
Is it possible to get this USER ID from passing the token only?
Must the app user necessarily provide his Spotify username via a form in a browser, besides authorizing the app when authentication is prompted?
Is it possible to tweak the wrapper above and implement a client which contemplates the parameters required for implicit flow? Would simply spotify = spotipy.Spotify(auth=token) work and get current usr data?

Also, by the following example form Spotipy docs, user must provide
his username at terminal:
That's because Spotipy caches tokens on disk. When no cache path is specified by the user the username simply gets appended to the files file extension as seen here. So the username specified is never being transmitted to any Spotify API endpoint.
1) Is it possible to get this USER ID from passing the token only?
Yes, using /v1/me instead of /v1/users/{user_id} will do exactly that assuming you are using an access token generated by Authorization Code flow or Implicit Grant flow.
2) Must the app user necessarily provide his Spotify username via a
form in a browser, besides authorizing the app when authentication is
prompted?
No, as seen in the first paragraph of my answer.
3) Is it possible to tweak the wrapper above and implement a client
which contemplates the parameters required for implicit flow? Would
simply spotify = spotipy.Spotify(auth=token) work and get current usr
data?
Spotipy seems to only use Authorization Code Flow right now. Due to you said you are
trying to implement a simple python client for Spotify api.
you should just implement Implicit Grant flow in your application. This has examples for all three Spotify authorization flows.

Generate access token by google login using oauth2

My front end in Angular JS.
It sends me google token after user logs in with gmail
In backend I verify the token and extract information from it as below
#csrf_exempt
def check(request):
CLIENT_ID = 'xxxxx'
try:
json_data = json.loads(request.body.decode('utf-8'))
idinfo = id_token.verify_oauth2_token(json_data['google_token'], requests.Request(), CLIENT_ID)
if idinfo['iss'] not in ['accounts.google.com', 'https://accounts.google.com']:
raise ValueError('Wrong issuer.')
print("idinfo")
print(idinfo)
Now I got the user details here and want to generate an access token to access my API's for every request.
Is there any built in function from oauth2 to generate an access token.
Any suggestion that would help me. Thanks.

Python Quickbooks: Unable to get correct authorization URL

I am using Python Quickbooks3 library to connect with QBO. I am doing as given in example but not getting correct URL. Below is my code:
from quickbooks import QuickBooks
clientkey = "qyprdLl476vKE74vVDP99Rl08gn1fr"
clientsecret = "nYFWsjeVspmNBQoIaIfPDABblYYBeX8SAhpDTMXY"
client = QuickBooks(
sandbox=True,
consumer_key=clientkey,
consumer_secret=clientsecret,
callback_url='http://localhost/qbo_token.php'
)
authorize_url = client.get_authorize_url()
request_token = client.request_token
request_token_secret = client.request_token_secret
print(authorize_url,request_token,request_token_secret)
It prints:
('https://appcenter.intuit.com/Connect/Begin?oauth_token=true', u'true', u'Ua3e7ZzPdac98RAZ1PSQJ6fjOEb9COiFDbdEQUdW')
Also, I want to skip browser based authorization as it would only be me using app. How can I do that?

Lots of questions here. For starters:
callback_url='http://localhost/qbo_token.php'
If you're using Python, why are you pointing to .php script for OAuth?
Are you sure you're using your sandbox OAuth consumer key and secret?
Also, I want to skip browser based authorization as it would only be
me using app. How can I do that?
You can't skip it.

Facebook Access Token for Single User Application

I'm creating an application on Facebook that will only ever have one user: me. I'm not making a GUI for the application, which means that there's no client side auth.
Is there a way that I can use my username and password or some other app information to get an access token for myself?
I'm familiar with the refresh token flows and everything for OAuth applications for other people, but I've never done this without some sort of Facebook login button, especially on a one person application. I'm happy to hard code in my user information.
I've tried using this:
access_token_url = 'https://graph.facebook.com/oauth/access_token?type=client_cred&client_id=' + config['app_id'] + '&client_secret=' + config['app_secret']
token_response = urllib.urlopen(access_token_url).read()
access_token = token_response.replace('access_token=', '')
session = FacebookSession(
config['app_id'],
config['app_secret'],
access_token,
)
But that doesn't give me an access token specific to my own account, only one for the application itself.

I managed to figure this out. Here's what I did:
I went to the Graph API Explorer (https://developers.facebook.com/tools/explorer) and then got an access token from there for my application.
Once I had the token I used this URL to get a long lived token using that access token:
token_exchange_url = 'https://graph.facebook.com/oauth/access_token?
client_id=APP_ID&
client_secret=APP_SECRET&
grant_type=fb_exchange_token&
fb_exchange_token=ACCESS_TOKEN'
exchange_response = urllib.urlopen(token_exchange_url).read()
access_token = exchange_response.replace('access_token=', '')
access_token = access_token[:access_token.index('&')]
I then saved that access_token and on any subsequent call I can update the access_token using that code whenever in order to make sure it's refreshed.

How do I get an OAuth access token in python?

(I asked this on superuser but got no response ...)
I'm trying to follow the tutorial for the Dropbox API at http://taught-process.blogspot.com/2012/05/asdlasd-asda-sd-asd-asdasd.html
But when I get to the last part
#Print the token for future reference
print access_token
What I get back is
<dropbox.session.OAuthToken object at 0x1102d4210>
How do I get the actual token? It should look something like:
oauth_token_secret=xxxxxxx&oauth_token=yyyyyyy
(I'm on a Mac)

Look around in the properties and methods of the object, to do so apply "dir" on the object.
In your case:
dir(access_token)
I'm pretty sure you're gonna find in this object something that will give you the token you need.

You've got the right object, yes. But you're dealing with an instance of a class.
<dropbox.session.OAuthToken object at 0x1102d4210>
This is an instance of the OAuthToken object the Dropbox SDK created for you. This token appears to have two attributes: key and secret. These would be your token key and secret. This is what you're after.
You can access them like this:
print access_token.key
print access_token.secret

Using the same tutorial for the Dropbox API at http://taught-process.blogspot.com/2012/05/asdlasd-asda-sd-asd-asdasd.html
Ended up with the following script that worked for me
# Include the Dropbox SDK libraries
from dropbox import client, rest, session
# Get your app key and secret from the Dropbox developer website
APP_KEY = '3w7xv4d9lrkc7c3'
APP_SECRET = '1v5f80mztbd3m9t'
# ACCESS_TYPE should be 'dropbox' or 'app_folder' as configured for your app
ACCESS_TYPE = 'app_folder'
sess = session.DropboxSession(APP_KEY, APP_SECRET, ACCESS_TYPE)
request_token = sess.obtain_request_token()
url = sess.build_authorize_url(request_token)
# Make the user sign in and authorize this token
print "url:", url
print "Please visit this website and press the 'Allow' button, then hit 'Enter' here."
raw_input()
# This will fail if the user didn't visit the above URL
access_token = sess.obtain_access_token(request_token)
#Print the token for future reference
print access_token.key
print access_token.secret