unauthorized_client error with Twitter Oauth2 social authentication

[gschurck]

I try to use Twitter Oauth2 social authentication with django-allauth, but I get this error :
unauthorized_client : Missing valid authorization header

I checked multiple times and all my Twitter config seems ok, with good callbacks URL and Tokens set in django-allauth.

Any idea on how to fix it ?

[katomaso]

Gettting the same thing: '{"error":"unauthorized_client","error_description":"Missing valid authorization header"}

It seems that allauth needs to encode your username/password into the initial requests as described in https://developer.twitter.com/en/docs/authentication/oauth-2-0/user-access-token

[katomaso]

You can add basic_auth = True into the TwitterOAuth2Adapter inside allauth\socialaccount\providers\twitter_oauth2\views.py as shown bellow. This gets you one step further but then I failed with a different error 403 Client Error: Forbidden for url: https://api.twitter.com/2/users/me?user.fields=id%2Cname%2Cusername%2Cverified%2Cprofile_image_url%2Ccreated_at

class TwitterOAuth2Adapter(OAuth2Adapter):
    ...
    basic_auth = True

[gschurck]

Thanks, I found that the missing part was the tweet.read scope, Twitter OAuth2 is working for me now with allauth !
I opened a PR to fix that, and I use my fork directly while waiting for the fix to be merged. (https://github.com/gschurck/django-allauth)

[katomaso]

Nice work! Do you know if there is a way how to re-define scope without modifying the source code? I tried settings.SOCIALACCOUNT_PROVIDERS['twitter']['SCOPE'] but it didn't work

[gschurck]

Thanks ! The good provider name is twitter_oauth2 and not twitter, then it should work.
But you don't have to modify the source code, you can also create a new custom provider inherited from Twitter OAuth2 and it's still quite simple.

[gschurck]

The fix as been merged, it will be included in the next release version 0.55.