Provider/Client 2-Legged OAuth I am understanding this correctly? (PHP implementation example)

Question

I provide a developer API to a set of data, I want to add 2-legged oauth authentication so I can authenticate developers apps to use the api. Firstly is this the best solution, for this type of authentication?

Secondly, from an implementation/flow point of view, is my understanding correct:

1. A random developer, goes to my site and uses a 'signup' page, which when submitted I generate them a api key and secret, that can be generated in anyway I wish.

2. They then use an oauth library like the php one found here to sign their request with these credentials.

   $consumer = new OAuthConsumer('thegeneratedkey', 'thegeneratedsecret');

$sig_method = new OAuthSignatureMethod_HMAC_SHA1;

//use oauth lib to sign request
$req = OAuthRequest::from_consumer_and_token($consumer, null, "GET", 'http://mydonaim/api/', array('someapimethod', 'somevalue'));
$sig_method = new OAuthSignatureMethod_HMAC_SHA1();
$req->sign_request($sig_method, $consumer, null);//note: double entry of token

1. My server then uses the oauth library to check the 'signature' of that request to authenticate the developer app.

$secret = 'secret'; // Ignore this line.

$secret = 'secret'; // Use the $_GET['oauth_consumer_key'] to find the secret in my system.
$consumer = new OAuthConsumer($_GET['oauth_consumer_key'], $secret);
$sig_method = new OAuthSignatureMethod_HMAC_SHA1;

$method = $_SERVER['REQUEST_METHOD'];
$uri = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
$sig = $_GET['oauth_signature'];    
$req = new OAuthRequest($method, $uri);

//token is null because we're doing 2-leg
$valid = $sig_method->check_signature( $req, $consumer, null, $sig );

Is this correct?

If so, does this authentication have to be done every time a request is made or can I generate a token of some kind to reduce the weight in each HTTP request from developer app to my api?

Answer 1

Firstly is this the best solution, for this type of authentication?

OAuth is designed to allow applications to get user data from a third party service without knowing the user's credentials. As long as that's what you need to do, then OAuth is the right solution for you.

If so, does this authentication have to be done every time a request is made or can I generate a token of some kind to reduce the weight in each HTTP request from developer app to my api?

Both sets of Tokens/Secrets must be provided with every single API request and passed into your OAuth library for authentication. This is how OAuth works. You should not add yet another token into the process, as that would only make things even more complicated, and it would confuse the crap out of any poor developer that finally got OAuth.

Remember, the key sets exist so you can revoke access to an entire application, and so users can do the same, assuming you give them an interface to do so. Both sets are included with each request so your application can check them for validity.

Don't worry about the "weight" of an HTTP request unless you've performed benchmarking and profiling and have determined that the size of requests is something you need to work on. I can pretty much guarantee that it's a non-issue.