MACRO NEPAL
Twitter OAuth 2.0 Integration in Java: Complete Guide
awiskar acharya
November 21, 2025
12:59 pm

Introduction to Twitter OAuth 2.0

Twitter has migrated to OAuth 2.0 as its primary authentication method, specifically implementing the OAuth 2.0 Authorization Code Flow with PKCE (Proof Key for Code Exchange). This provides a more secure authentication flow for web, mobile, and desktop applications.

OAuth 2.0 Flow Overview

  1. Application Registration - Register your app in the Twitter Developer Portal
  2. PKCE Code Challenge - Generate code verifier and challenge
  3. Authorization Request - Redirect user to Twitter authorization
  4. Callback Handling - Receive authorization code
  5. Token Exchange - Exchange code for access token
  6. API Calls - Use access token to make Twitter API requests

Setting Up Twitter Developer Account

Prerequisites

  1. Twitter Developer Account - Apply at developer.twitter.com
  2. App Registration - Create a new app in the developer portal
  3. Callback URLs - Configure authorized redirect URIs
  4. API Keys - Note your Client ID and Client Secret

Dependencies Setup

Maven Configuration

<dependencies>
<!-- OAuth 2.0 Client -->
<dependency>
<groupId>com.github.scribejava</groupId>
<artifactId>scribejava-core</artifactId>
<version>8.3.3</version>
</dependency>
<!-- HTTP Client -->
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
<version>4.5.14</version>
</dependency>
<!-- JSON Processing -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.15.2</version>
</dependency>
<!-- Spring Boot Starter Web (Optional) -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<version>2.7.0</version>
</dependency>
</dependencies>

Gradle Configuration

dependencies {
implementation 'com.github.scribejava:scribejava-core:8.3.3'
implementation 'org.apache.httpcomponents:httpclient:4.5.14'
implementation 'com.fasterxml.jackson.core:jackson-databind:2.15.2'
implementation 'org.springframework.boot:spring-boot-starter-web:2.7.0'
}

Core OAuth 2.0 Implementation

PKCE Code Generator

import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Base64;
public class PKCEUtil {
private static final SecureRandom secureRandom = new SecureRandom();
private static final Base64.Encoder base64Encoder = Base64.getUrlEncoder().withoutPadding();
/**
* Generate a cryptographically random code verifier
*/
public static String generateCodeVerifier() {
byte[] codeVerifier = new byte[32];
secureRandom.nextBytes(codeVerifier);
return base64Encoder.encodeToString(codeVerifier);
}
/**
* Generate code challenge from code verifier using S256 method
*/
public static String generateCodeChallenge(String codeVerifier) throws Exception {
byte[] bytes = codeVerifier.getBytes("US-ASCII");
MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
messageDigest.update(bytes, 0, bytes.length);
byte[] digest = messageDigest.digest();
return base64Encoder.encodeToString(digest);
}
/**
* Generate both code verifier and challenge
*/
public static PKCEPair generatePKCECodes() throws Exception {
String verifier = generateCodeVerifier();
String challenge = generateCodeChallenge(verifier);
return new PKCEPair(verifier, challenge);
}
public static class PKCEPair {
private final String codeVerifier;
private final String codeChallenge;
public PKCEPair(String codeVerifier, String codeChallenge) {
this.codeVerifier = codeVerifier;
this.codeChallenge = codeChallenge;
}
public String getCodeVerifier() { return codeVerifier; }
public String getCodeChallenge() { return codeChallenge; }
}
}

Twitter OAuth 2.0 Service

import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.apache.http.HttpEntity;
import org.apache.http.NameValuePair;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.message.BasicNameValuePair;
import java.util.*;
public class TwitterOAuth2Service {
private final String clientId;
private final String clientSecret;
private final String redirectUri;
private final CloseableHttpClient httpClient;
private final ObjectMapper objectMapper;
// Twitter OAuth 2.0 endpoints
private static final String AUTHORIZATION_URL = "https://twitter.com/i/oauth2/authorize";
private static final String TOKEN_URL = "https://api.twitter.com/2/oauth2/token";
private static final String USER_INFO_URL = "https://api.twitter.com/2/users/me";
public TwitterOAuth2Service(String clientId, String clientSecret, String redirectUri) {
this.clientId = clientId;
this.clientSecret = clientSecret;
this.redirectUri = redirectUri;
this.httpClient = HttpClients.createDefault();
this.objectMapper = new ObjectMapper();
}
/**
* Generate authorization URL for Twitter OAuth 2.0
*/
public String generateAuthorizationUrl(String state, String codeChallenge, String... scopes) {
String scope = String.join(" ", scopes);
return AUTHORIZATION_URL + "?" +
"response_type=code" +
"&client_id=" + clientId +
"&redirect_uri=" + redirectUri +
"&scope=" + scope +
"&state=" + state +
"&code_challenge=" + codeChallenge +
"&code_challenge_method=S256";
}
/**
* Exchange authorization code for access token
*/
public TokenResponse exchangeCodeForToken(String authorizationCode, String codeVerifier) throws Exception {
HttpPost httpPost = new HttpPost(TOKEN_URL);
// Set headers
String authHeader = Base64.getEncoder().encodeToString(
(clientId + ":" + clientSecret).getBytes());
httpPost.setHeader("Authorization", "Basic " + authHeader);
httpPost.setHeader("Content-Type", "application/x-www-form-urlencoded");
// Set form parameters
List<NameValuePair> params = new ArrayList<>();
params.add(new BasicNameValuePair("code", authorizationCode));
params.add(new BasicNameValuePair("grant_type", "authorization_code"));
params.add(new BasicNameValuePair("client_id", clientId));
params.add(new BasicNameValuePair("redirect_uri", redirectUri));
params.add(new BasicNameValuePair("code_verifier", codeVerifier));
httpPost.setEntity(new UrlEncodedFormEntity(params));
try (CloseableHttpResponse response = httpClient.execute(httpPost)) {
HttpEntity entity = response.getEntity();
JsonNode jsonResponse = objectMapper.readTree(entity.getContent());
if (response.getStatusLine().getStatusCode() == 200) {
return new TokenResponse(
jsonResponse.get("access_token").asText(),
jsonResponse.get("token_type").asText(),
jsonResponse.has("expires_in") ? jsonResponse.get("expires_in").asInt() : 0,
jsonResponse.has("scope") ? jsonResponse.get("scope").asText() : "",
jsonResponse.has("refresh_token") ? jsonResponse.get("refresh_token").asText() : null
);
} else {
String error = jsonResponse.get("error").asText();
String errorDescription = jsonResponse.has("error_description") ? 
jsonResponse.get("error_description").asText() : "";
throw new RuntimeException("Token exchange failed: " + error + " - " + errorDescription);
}
}
}
/**
* Get user information using access token
*/
public TwitterUser getUserInfo(String accessToken) throws Exception {
HttpGet httpGet = new HttpGet(USER_INFO_URL + "?user.fields=id,name,username,profile_image_url");
httpGet.setHeader("Authorization", "Bearer " + accessToken);
try (CloseableHttpResponse response = httpClient.execute(httpGet)) {
HttpEntity entity = response.getEntity();
JsonNode jsonResponse = objectMapper.readTree(entity.getContent());
if (response.getStatusLine().getStatusCode() == 200) {
JsonNode userData = jsonResponse.get("data");
return new TwitterUser(
userData.get("id").asText(),
userData.get("name").asText(),
userData.get("username").asText(),
userData.has("profile_image_url") ? userData.get("profile_image_url").asText() : null
);
} else {
throw new RuntimeException("Failed to get user info: " + jsonResponse.toString());
}
}
}
/**
* Refresh access token using refresh token
*/
public TokenResponse refreshToken(String refreshToken) throws Exception {
HttpPost httpPost = new HttpPost(TOKEN_URL);
String authHeader = Base64.getEncoder().encodeToString(
(clientId + ":" + clientSecret).getBytes());
httpPost.setHeader("Authorization", "Basic " + authHeader);
httpPost.setHeader("Content-Type", "application/x-www-form-urlencoded");
List<NameValuePair> params = new ArrayList<>();
params.add(new BasicNameValuePair("grant_type", "refresh_token"));
params.add(new BasicNameValuePair("refresh_token", refreshToken));
params.add(new BasicNameValuePair("client_id", clientId));
httpPost.setEntity(new UrlEncodedFormEntity(params));
try (CloseableHttpResponse response = httpClient.execute(httpPost)) {
HttpEntity entity = response.getEntity();
JsonNode jsonResponse = objectMapper.readTree(entity.getContent());
if (response.getStatusLine().getStatusCode() == 200) {
return new TokenResponse(
jsonResponse.get("access_token").asText(),
jsonResponse.get("token_type").asText(),
jsonResponse.get("expires_in").asInt(),
jsonResponse.get("scope").asText(),
jsonResponse.has("refresh_token") ? jsonResponse.get("refresh_token").asText() : null
);
} else {
throw new RuntimeException("Token refresh failed: " + jsonResponse.toString());
}
}
}
// Data transfer objects
public static class TokenResponse {
private final String accessToken;
private final String tokenType;
private final int expiresIn;
private final String scope;
private final String refreshToken;
public TokenResponse(String accessToken, String tokenType, int expiresIn, 
String scope, String refreshToken) {
this.accessToken = accessToken;
this.tokenType = tokenType;
this.expiresIn = expiresIn;
this.scope = scope;
this.refreshToken = refreshToken;
}
// Getters
public String getAccessToken() { return accessToken; }
public String getTokenType() { return tokenType; }
public int getExpiresIn() { return expiresIn; }
public String getScope() { return scope; }
public String getRefreshToken() { return refreshToken; }
}
public static class TwitterUser {
private final String id;
private final String name;
private final String username;
private final String profileImageUrl;
public TwitterUser(String id, String name, String username, String profileImageUrl) {
this.id = id;
this.name = name;
this.username = username;
this.profileImageUrl = profileImageUrl;
}
// Getters
public String getId() { return id; }
public String getName() { return name; }
public String getUsername() { return username; }
public String getProfileImageUrl() { return profileImageUrl; }
}
}

Spring Boot Integration

Application Properties

# Twitter OAuth 2.0 Configuration
twitter.oauth2.client.id=your-client-id-here
twitter.oauth2.client.secret=your-client-secret-here
twitter.oauth2.redirect-uri=http://localhost:8080/auth/twitter/callback
# Server Configuration
server.port=8080
server.servlet.session.timeout=30m

Spring Configuration

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@Configuration
public class TwitterOAuthConfig {
@Value("${twitter.oauth2.client.id}")
private String clientId;
@Value("${twitter.oauth2.client.secret}")
private String clientSecret;
@Value("${twitter.oauth2.redirect-uri}")
private String redirectUri;
@Bean
public TwitterOAuth2Service twitterOAuth2Service() {
return new TwitterOAuth2Service(clientId, clientSecret, redirectUri);
}
}

Spring MVC Controller

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.*;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.view.RedirectView;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
import java.util.HashMap;
import java.util.Map;
import java.util.UUID;
@Controller
@RequestMapping("/auth/twitter")
public class TwitterOAuthController {
@Autowired
private TwitterOAuth2Service twitterOAuthService;
private static final String SESSION_STATE_KEY = "oauth2_state";
private static final String SESSION_CODE_VERIFIER_KEY = "oauth2_code_verifier";
/**
* Initiate Twitter OAuth 2.0 flow
*/
@GetMapping("/login")
public RedirectView login(HttpSession session) throws Exception {
// Generate state and PKCE codes
String state = UUID.randomUUID().toString();
PKCEUtil.PKCEPair pkcePair = PKCEUtil.generatePKCECodes();
// Store in session for validation
session.setAttribute(SESSION_STATE_KEY, state);
session.setAttribute(SESSION_CODE_VERIFIER_KEY, pkcePair.getCodeVerifier());
// Define required scopes
String[] scopes = {
"tweet.read",
"users.read",
"offline.access"  // Required for refresh tokens
};
// Generate authorization URL
String authUrl = twitterOAuthService.generateAuthorizationUrl(
state, pkcePair.getCodeChallenge(), scopes);
return new RedirectView(authUrl);
}
/**
* Handle OAuth 2.0 callback
*/
@GetMapping("/callback")
public ModelAndView callback(
@RequestParam("code") String code,
@RequestParam("state") String state,
HttpServletRequest request) {
HttpSession session = request.getSession();
String sessionState = (String) session.getAttribute(SESSION_STATE_KEY);
String codeVerifier = (String) session.getAttribute(SESSION_CODE_VERIFIER_KEY);
Map<String, Object> model = new HashMap<>();
try {
// Validate state parameter
if (!state.equals(sessionState)) {
model.put("error", "Invalid state parameter");
return new ModelAndView("oauth-error", model);
}
// Exchange code for tokens
TwitterOAuth2Service.TokenResponse tokenResponse = 
twitterOAuthService.exchangeCodeForToken(code, codeVerifier);
// Get user information
TwitterOAuth2Service.TwitterUser user = 
twitterOAuthService.getUserInfo(tokenResponse.getAccessToken());
// Clear session attributes
session.removeAttribute(SESSION_STATE_KEY);
session.removeAttribute(SESSION_CODE_VERIFIER_KEY);
// Store tokens in session (in production, use secure storage)
session.setAttribute("twitter_access_token", tokenResponse.getAccessToken());
session.setAttribute("twitter_refresh_token", tokenResponse.getRefreshToken());
session.setAttribute("twitter_user", user);
model.put("user", user);
model.put("accessToken", tokenResponse.getAccessToken());
return new ModelAndView("oauth-success", model);
} catch (Exception e) {
model.put("error", "Authentication failed: " + e.getMessage());
return new ModelAndView("oauth-error", model);
}
}
/**
* Get current user profile
*/
@GetMapping("/profile")
@ResponseBody
public Map<String, Object> getProfile(HttpSession session) {
Map<String, Object> response = new HashMap<>();
String accessToken = (String) session.getAttribute("twitter_access_token");
TwitterOAuth2Service.TwitterUser user = 
(TwitterOAuth2Service.TwitterUser) session.getAttribute("twitter_user");
if (user != null && accessToken != null) {
response.put("success", true);
response.put("user", user);
} else {
response.put("success", false);
response.put("error", "Not authenticated");
}
return response;
}
/**
* Logout - clear session
*/
@GetMapping("/logout")
public String logout(HttpSession session) {
session.invalidate();
return "redirect:/";
}
}

Advanced Twitter API Integration

Twitter API Client

import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.entity.StringEntity;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import java.util.HashMap;
import java.util.Map;
public class TwitterApiClient {
private final CloseableHttpClient httpClient;
private final ObjectMapper objectMapper;
private final String baseUrl = "https://api.twitter.com/2";
public TwitterApiClient() {
this.httpClient = HttpClients.createDefault();
this.objectMapper = new ObjectMapper();
}
/**
* Post a tweet
*/
public String postTweet(String accessToken, String text) throws Exception {
HttpPost httpPost = new HttpPost(baseUrl + "/tweets");
httpPost.setHeader("Authorization", "Bearer " + accessToken);
httpPost.setHeader("Content-Type", "application/json");
Map<String, String> tweetData = new HashMap<>();
tweetData.put("text", text);
String jsonBody = objectMapper.writeValueAsString(tweetData);
httpPost.setEntity(new StringEntity(jsonBody));
try (CloseableHttpResponse response = httpClient.execute(httpPost)) {
JsonNode jsonResponse = objectMapper.readTree(response.getEntity().getContent());
if (response.getStatusLine().getStatusCode() == 201) {
return jsonResponse.get("data").get("id").asText();
} else {
throw new RuntimeException("Failed to post tweet: " + jsonResponse.toString());
}
}
}
/**
* Get user's tweets
*/
public JsonNode getUserTweets(String accessToken, String userId) throws Exception {
String url = baseUrl + "/users/" + userId + "/tweets?max_results=10&tweet.fields=created_at,public_metrics";
HttpGet httpGet = new HttpGet(url);
httpGet.setHeader("Authorization", "Bearer " + accessToken);
try (CloseableHttpResponse response = httpClient.execute(httpGet)) {
return objectMapper.readTree(response.getEntity().getContent());
}
}
/**
* Search for tweets
*/
public JsonNode searchTweets(String accessToken, String query) throws Exception {
String url = baseUrl + "/tweets/search/recent?query=" + 
java.net.URLEncoder.encode(query, "UTF-8") + 
"&max_results=10";
HttpGet httpGet = new HttpGet(url);
httpGet.setHeader("Authorization", "Bearer " + accessToken);
try (CloseableHttpResponse response = httpClient.execute(httpGet)) {
return objectMapper.readTree(response.getEntity().getContent());
}
}
}

Security Best Practices

1. State Parameter Validation

public class SecurityUtil {
/**
* Validate state parameter to prevent CSRF attacks
*/
public static boolean validateState(String receivedState, String expectedState) {
if (receivedState == null || expectedState == null) {
return false;
}
return receivedState.equals(expectedState);
}
/**
* Generate secure random state
*/
public static String generateSecureState() {
SecureRandom secureRandom = new SecureRandom();
byte[] state = new byte[32];
secureRandom.nextBytes(state);
return Base64.getUrlEncoder().withoutPadding().encodeToString(state);
}
}

2. Token Storage Security

import org.springframework.stereotype.Service;
import java.util.concurrent.ConcurrentHashMap;
@Service
public class TokenStorageService {
private final Map<String, TokenData> tokenStore = new ConcurrentHashMap<>();
public void storeTokens(String sessionId, String accessToken, 
String refreshToken, long expiresIn) {
TokenData tokenData = new TokenData(accessToken, refreshToken, 
System.currentTimeMillis() + (expiresIn * 1000));
tokenStore.put(sessionId, tokenData);
}
public String getAccessToken(String sessionId) {
TokenData tokenData = tokenStore.get(sessionId);
if (tokenData != null && !tokenData.isExpired()) {
return tokenData.getAccessToken();
}
return null;
}
public void removeTokens(String sessionId) {
tokenStore.remove(sessionId);
}
private static class TokenData {
private final String accessToken;
private final String refreshToken;
private final long expirationTime;
public TokenData(String accessToken, String refreshToken, long expirationTime) {
this.accessToken = accessToken;
this.refreshToken = refreshToken;
this.expirationTime = expirationTime;
}
public String getAccessToken() { return accessToken; }
public String getRefreshToken() { return refreshToken; }
public boolean isExpired() { return System.currentTimeMillis() > expirationTime; }
}
}

Error Handling and Troubleshooting

Common Error Codes

public class TwitterOAuthErrorHandler {
public static String getErrorMessage(String errorCode) {
switch (errorCode) {
case "invalid_request":
return "The request is missing a required parameter or is malformed.";
case "unauthorized_client":
return "The client is not authorized to request an authorization code.";
case "access_denied":
return "The resource owner or authorization server denied the request.";
case "unsupported_response_type":
return "The authorization server does not support this response type.";
case "invalid_scope":
return "The requested scope is invalid, unknown, or malformed.";
case "server_error":
return "The authorization server encountered an unexpected condition.";
case "temporarily_unavailable":
return "The authorization server is currently unavailable.";
default:
return "An unknown error occurred.";
}
}
}

Testing the Implementation

Test Controller

@RestController
@RequestMapping("/api/twitter")
public class TwitterTestController {
@Autowired
private TwitterOAuth2Service twitterOAuthService;
@Autowired
private TwitterApiClient twitterApiClient;
@PostMapping("/tweet")
public ResponseEntity<Map<String, Object>> postTweet(
@RequestParam String text,
HttpSession session) {
Map<String, Object> response = new HashMap<>();
String accessToken = (String) session.getAttribute("twitter_access_token");
if (accessToken == null) {
response.put("success", false);
response.put("error", "Not authenticated");
return ResponseEntity.status(401).body(response);
}
try {
String tweetId = twitterApiClient.postTweet(accessToken, text);
response.put("success", true);
response.put("tweetId", tweetId);
return ResponseEntity.ok(response);
} catch (Exception e) {
response.put("success", false);
response.put("error", e.getMessage());
return ResponseEntity.status(500).body(response);
}
}
}

Conclusion

This comprehensive Twitter OAuth 2.0 implementation in Java provides:

  1. Secure PKCE-based authentication flow
  2. Spring Boot integration for web applications
  3. Token management with refresh capability
  4. Twitter API client for common operations
  5. Security best practices implementation

The implementation follows OAuth 2.0 security standards and provides a robust foundation for integrating Twitter authentication and API functionality into Java applications. Remember to handle tokens securely in production, implement proper error handling, and regularly update dependencies for security patches.

Category : JAVA

Leave a Reply

Your email address will not be published. Required fields are marked *


Macro Nepal Helper