South

Please Use North Instead

This library has been superseded by North. Please use that instead, as its code based is an improvement from South in almost every respect and it includes the ability to provide the server side of the oAuth system as well.

How To

Load South through Quicklisp or ASDF:

(ql:quickload :south)

First you need to tell South about the service you want to interact with. For this you will need at least the following three URLs oauth/request-token, oauth/authorize, oauth/access-token as well as the api-key and api-secret of your oAuth application that you want to use to connect. To set up South you can either set the according special variables directly or use the prepare function:

(south:prepare
  :oauth/request-token "https://api.twitter.com/oauth/request_token"
  :oauth/authenticate "https://api.twitter.com/oauth/authenticate"
  :oauth/authorize "https://api.twitter.com/oauth/authorize"
  :oauth/access-token "https://api.twitter.com/oauth/access_token"
  :api-key key
  :api-secret secret)

Twitter requires an additional authenticate URL, which is otherwise set to the same as the authorize address. To start the authentication process simply call initiate-authentication. If your addresses and api codes are correct, it should return an URL that the user has to visit in their browser.

(south:initiate-authentication)

By default this will use the SERVER method, which loads and starts a hunchentoot instance on *SERVER-PORT*. After the remote authentication has been accepted it redirects to this local server. If you want to handle the server yourself, you should instead pass a callback URL as the :method to initiate-authentication. Depending on the service it might provide additional non-standard authentication methods, like twitter's PIN. The PIN method is already integrated into South, but anything beyond that you will have to add yourself. If you choose to use your own server or a different method, you will need to call complete-authentication with the verifier and optionally the access-token.

(south:complete-authentication verifier :token access-token)

The SERVER method will automatically call complete-authentication once it receives the request and shuts itself down. If complete-authentication returns successfully you should now be all set to perform oAuth requests. To request with oAuth signatures, you can use the signed-request function.

(south:signed-request "https://api.twitter.com/1.1/account/verify_credentials.json")

Depending on how your service requires it, posting form data may require special treatment. South provides a signed-data-request function that is geared towards how twitter requires it, but it may also work for other services.

If you need to handle multiple oAuth accounts at the same time you may want to use the with-oauth-environment macro to establish dynamic bindings around the internal special variables. The macro accepts parameters for all the environment variables so you may directly set them without needing to call prepare.

Applications

If your application uses South, please let me know so I can list it here!

Humbler, a Tumblr API interface library.

Copyright

south is licensed under the Artistic license. © Nicolas Hafner <shinmera@tymoon.eu> . This library can be obtained on https://github.com/Shinmera/south.

Package Index

SOUTH (ORG.TYMOONNEXT.SOUTH)

special

`AUTHENTICATION-CALLBACK`

Function called when COMPLETE-AUTHENTICATION is called.
Two arguments are passed, the ACCESS-TOKEN and the ACCESS-SECRET.

special

`EXTERNAL-FORMAT`

The external format used for encoding/decoding.

special
*OAUTH-ACCESS-SECRET*
```
 
```
special
*OAUTH-ACCESS-TOKEN*
```
 
```
special
*OAUTH-API-KEY*
```
 
```
special
*OAUTH-API-SECRET*
```
 
```
special
*OAUTH-SIGNATURE-METHOD*
```
 
```
special
*OAUTH-VERIFIER-LOCATION*
```
 
```
special
*OAUTH-VERSION*
```
 
```
special
*OAUTH/ACCESS-TOKEN*
```
 
```
special
*OAUTH/AUTHENTICATE*
```
 
```
special
*OAUTH/AUTHORIZE*
```
 
```
special
*OAUTH/REQUEST-TOKEN*
```
 
```
special
*SERVER-PORT*
```
 
```
condition
OAUTH-ERROR
```
 
```
condition
OAUTH-PARAMETER-MISSING
```
 
```
condition
OAUTH-REQUEST-ERROR
```
 
```
accessor (
HTTP-BODY
CONDITION)
```
 
```
accessor (
HTTP-HEADERS
CONDITION)
```
 
```
accessor (
HTTP-STATUS
CONDITION)
```
 
```
accessor (
PARAMETER
CONDITION)
```
 
```
accessor (
TARGET-HEADERS
CONDITION)
```
 
```
accessor (
TARGET-METHOD
CONDITION)
```
 
```
accessor (
TARGET-PARAMETERS
CONDITION)
```
 
```
accessor (
TARGET-URL
CONDITION)
```
 
```

function (

`COMPLETE-AUTHENTICATION`

VERIFIER &OPTIONAL (TOKEN *OAUTH-ACCESS-TOKEN*))

Finishes the authentication procedure by retrieving the access token.
Sets the *OAUTH-TOKEN* and *OAUTH-TOKEN-SECRET* to their respective values.

function (

`GENERATE-NONCE`

)

Generate a NONCE to use for requests. Currently this simply uses a v4-UUID.

function (

`INITIATE-AUTHENTICATION`

&KEY (METHOD :SERVER) (API-KEY *OAUTH-API-KEY*)
 (API-SECRET *OAUTH-API-SECRET*)

)

Starts the authentication process and returns an URL that the user has to visit.
METHOD can be one of :PIN :SERVER or a string designating a callback URL.
Note that the :PIN method is NOT STANDARD and thus might not be available for your service.
See OAUTH/AUTHORIZE, INITIATE-SERVER-AUTHENTICATION and OAUTH/AUTHENTICATE respectively.

function (

`INITIATE-SERVER-AUTHENTICATION`

)

Initiate the authentication through the server mechanism.
This is the same as the redirect mechanism, except it starts up
a Hunchentoot server automatically and handles the callback for
you. The server will be started on *SERVER-PORT* and will be shut
down automatically after a single request.

function (

`OAUTH/ACCESS-TOKEN`

VERIFIER)

Turn the tokens received through the authentication into an access token.

According to spec https://dev.twitter.com/docs/auth/implementing-sign-twitter

function (

`OAUTH/AUTHENTICATE`

CALLBACK-URL)

Initiate the authentication through the redirect mechanism.
Returns an URL that the user has to open in the browser.
Upon successful authentication, the page should redirect back
to the specified callback url. This callback endpoint should then
pass the proper parameters to COMPLETE-AUTHENTICATION.

According to spec https://dev.twitter.com/docs/auth/implementing-sign-twitter

function (

`OAUTH/AUTHORIZE`

)

Initiate the authentication through the PIN mechanism.
Returns an URL that the user has to open in the browser.
This page should, upon successful authentication, return a PIN
that has to be initialized by passing it to COMPLETE-AUTHENTICATION.

According to spec https://dev.twitter.com/docs/auth/pin-based-authorization

function (

`OAUTH/REQUEST-TOKEN`

CALLBACK)

Query for a request token using the specified callback.
Returns an ALIST containing :OAUTH-TOKEN, :OAUTH-TOKEN-SECRET and 
:OAUTH-CALLBACK-CONFIRMED, the first two being strings and the last a boolean.

According to spec https://dev.twitter.com/docs/auth/implementing-sign-twitter

function (

`PIN-REQUEST-TOKEN`

)

Query for a PIN based request token.
Seee CALLBACK-REQUEST-TOKEN.

According to spec https://dev.twitter.com/docs/auth/pin-based-authorization

function (

`PREPARE`

&KEY OAUTH/REQUEST-TOKEN OAUTH/AUTHORIZE (OAUTH/AUTHENTICATE OAUTH/AUTHORIZE)
 OAUTH/ACCESS-TOKEN API-KEY API-SECRET

)

Cosmetic function to set the oauth request URLs and api-key and -secret.
This only sets the internal value of the parameter if it is non-NIL.

function (

`RESET`

)

Resets the internal API-KEY, API-SECRET, ACCESS-TOKEN and ACCESS-SECRET to NIL.
This does not change the oauth request URLs.

function (

`SIGNED-DATA-PARAMETERS-REQUEST`

REQUEST-URL &KEY DATA-PARAMETERS PARAMETERS OAUTH-PARAMETERS
 ADDITIONAL-HEADERS (METHOD :POST) DRAKMA-PARAMS

)

Issue a signed data request against the API.
See SIGNED-REQUEST. The difference to SIGNED-DATA-REQUEST is that 
the default PARAMETERS are used to calculate the authorization header,
whereas the DATA-PARAMETERS are not. In SINGED-DATA-REQUEST, neither
of the parameters are used for the header.

function (
SIGNED-DATA-REQUEST
REQUEST-URL &KEY DATA-PARAMETERS PARAMETERS OAUTH-PARAMETERS ADDITIONAL-HEADERS (METHOD :POST) DRAKMA-PARAMS)
```
Issue a signed data request against the API.
See SIGNED-REQUEST.

According to spec https://dev.twitter.com/docs/uploading-media
```

function (

`SIGNED-REQUEST`

REQUEST-URL &KEY PARAMETERS OAUTH-PARAMETERS ADDITIONAL-HEADERS (METHOD :POST)
 DRAKMA-PARAMS

)

Issue a signed request against the API.
This requires the *oauth-api-key*, *oauth-signature-method*,
*oauth-version* and at least *oauth-api-secret* to be set.
See CREATE-SIGNATURE.
For return values see DRAKMA:HTTP-REQUEST

According to spec https://dev.twitter.com/docs/auth/authorizing-request

function (

`SIGNED-STREAM-REQUEST`

REQUEST-URL &KEY PARAMETERS OAUTH-PARAMETERS ADDITIONAL-HEADERS (METHOD :POST)
 DRAKMA-PARAMS

)

Issue a signed data request against the API.
See SIGNED-REQUEST. Returns values according to DRAKMA:HTTP-REQUEST with :WANT-STREAM T

function (

`URL-DECODE`

STRING &OPTIONAL (EXTERNAL-FORMAT *EXTERNAL-FORMAT*))

Returns a URL-decoded version of the string STRING external format EXTERNAL-FORMAT.

According to spec https://dev.twitter.com/docs/auth/percent-encoding-parameters

function (

`URL-ENCODE`

THING &OPTIONAL (EXTERNAL-FORMAT *EXTERNAL-FORMAT*))

Returns a URL-encoded version of the string STRING or OCTET-SEQUENCE using the external format EXTERNAL-FORMAT.

According to spec https://dev.twitter.com/docs/auth/percent-encoding-parameters

macro (

`WITH-OAUTH-ENVIRONMENT`

&REST ARGS)

Establishes an environment for all oauth related special variables.
Unless a non-NIL value is provided for a parameter it is bound to the current value of the according special variable.