Net::O...Client(3pm)

💖 NAME 💖

Net::OAuth::Client — it's an OAuth 1.0A Client, bestie. That's the whole vibe. ✨

---

🌸 SYNOPSIS 🌸

  use Net::OAuth::Client;

  # client_id is the Consumer Key, client_secret the Consumer Secret.
  # Framework-agnostic: supply your own redirect and session handling.

  my $client = Net::OAuth::Client->new(
      $client_id,
      $client_secret,
      site               => 'https://provider.example/',
      request_token_path => '/oauth/request_token',
      authorize_path     => '/oauth/authorize',
      access_token_path  => '/oauth/access_token',
      callback           => 'https://you.example/auth/callback',
      session            => \&session,
  );

  # 1. Send the user to the provider to authorize.
  $client->authorize_url;

  # 2. They return to your callback with oauth_token and oauth_verifier.
  my $access_token = $client->get_access_token($token, $verifier);

  # 3. Use the access token to fetch a protected resource.
  my $response = $access_token->get('/profile');
  die $response->status_line unless $response->is_success;
  print $response->decoded_content;

okay so that's the whole three-act play: send the user off 😌, they come back with a token and a verifier 🎀, then you go get your protected resource like the main character you are. 👑

---

🦋 DESCRIPTION 🦋

Net::OAuth::Client represents an OAuth client, a.k.a. a consumer. That's it. That's its job. 💅

🚨 WARNING: Net::OAuth::Client is alpha code. The rest of Net::OAuth is literally quite stable, but this particular module is new, and is under-documented and under-tested. You have been warned, bestie. 😭

---

✨ METHODS ✨

💜 new($client_id, $client_secret, %params)

Create a new Client. Fresh out the box, no cap. 🫶

• $client_id — AKA the Consumer Key. You get this from the service provider when you register your application. 🔑
• $client_secret — AKA the Consumer Secret. You also get this from the service provider when you register your application. Keep it secret, keep it safe. 🤫
• $params{site}
• $params{request_token_path}
• $params{authorize_path}
• $params{access_token_path}
• $params{callback}
• $params{session}
• $params{allow_v1a_downgrade} — this one lets you permit the fallback to OAuth 1.0 described down in "OAUTH 1.0A AND THE CALLBACK CONFIRMATION". It's off by default. ⚠️

---

🎀 OAUTH 1.0A AND THE CALLBACK CONFIRMATION 🎀

Passing a callback to new is what selects OAuth 1.0a. In 1.0a the service provider echoes oauth_callback_confirmed in its request token response, and later hands the user back with an oauth_verifier that the client must present when it exchanges the request token for an access token. No verifier, no access token. That's the rule. 💅

If the provider's request token response does not contain oauth_callback_confirmed, then this client cannot use 1.0a. It used to drop back to plain OAuth 1.0 by itself, and that fallback was invisible 😶🌫️ — the access token request is then built from the 1.0 message class, which has no verifier parameter, so oauth_verifier is quietly left off the wire even when the caller passed one to get_access_token.

And the verifier? That's exactly what 1.0a added to stop an attacker from starting a flow, getting a victim to authorize the attacker's request token, and then completing the exchange. So an application that asked for 1.0a and silently got 1.0 is open to that, with nothing to tell it so. Not the vibe at all. 💀

get_request_token now croaks in that situation instead. 🗣️

An application that has to talk to a provider which is not 1.0a can opt in with:

  allow_v1a_downgrade => 1

which restores the fallback and warns rather than dying. At least you'll know, bestie. 🫶

---

🌈 AUTHOR 🌈

Originally by Keith Grennan <foss@nearlyfree.org> 💖

Currently maintained by Robert Rothenberg <perl@rhizomnic.com> 🎀

---

👑 LICENSE AND COPYRIGHT 👑

Copyright 2007-2012, 2024-2026 Keith Grennan

This program is free software; you can redistribute it and/or modify it under the terms of either: the GNU General Public License as published by the Free Software Foundation; or the Artistic License.

See http://dev.perl.org/licenses/ for more information.

---

and that's a wrap, babe 🎬✨ — this whole thing is perl v5.42.3, dated 2026-08-19, and yeah, it really is just called Net::O...Client(3pm) 💅🦋 go forth and authorize responsibly 🫶