PlaceSpeak Connect

Step 1: Get User Authorization

Redirect your user to:

https://www.placespeak.com/connect/authorize/?client_id=<Your Key>&response_type=code&scope=user_info&redirect_uri=<Your Redirect URi>

E.g. https://www.placespeak.com/connect/authorize/?client_id=05062498611dcacc4faf7b0aaad878&response_type=code&scope=user_info&redirect_uri=http://www.example.com/placespeak-connect/

N.B. If the user has authorized your application previously, and the previously provided access_token has not yet expired, we will return a new code automatically, without the user having to re-authorize.

Step 2: Get Request an Access Token

If the user authorizes your request, they will be redirected to the redirect URi that you provided, with a query string parameter code

E.g. http://www.example.com/placespeak-connect/?code=7442cc38f095529f3b76a1ca6de55272b691e5c80a0c8ee829ce0db672c32c9c

With this code, you can request an access token.

Make a POST request to https://www.placespeak.com/connect/token/ with the following POST data:

cURL example

The data returned will be of the following format:

The access token is valid for 1 hour. If you need to update user data at some point in the future, please see Refreshing access tokens.

Step 3: Get User Information

Once you have an access token, you can make an API request for the user information.

Make a GET request to https://www.placespeak.com/connect/api/user_info/. The HTTP_AUTHORIZATION header is required with the following value:

'Bearer <Your access token>'

cURL example

This will return the user data in the following format:

Security Considerations

When dealing with OAuth, there are several steps that you should take in order to ensure that you don't accidentally leak client information or have a potential security hole.

HTTPS

One of the major changes to OAuth when releasing version 2.0 was removing transport considerations from the protocol, instead relying on implementors to handle the transport of codes and tokens themselves. What this means in practical terms is that HTTPS is required. This will prevent any surprises and will prevent the codes from being captured while in transit.

State Parameter

When requesting an authorization code (by directing the user to PlaceSpeak.com), one of the parameters you should pass is the state parameter. To us, this is an opaque blob, but should be semi-random to help prevent cross-site scripting attacks.

Client Secret

Understand that the only time the client secret should be sent to us is as part of exchanging the authorization code for an access token, and should always be sent as part of a POST operation.

Refreshing access tokens

If you need to request User Information again, but your access_token has expired, you will need to refresh it using the refresh_token provided with the original access_token.

This is similar to requesting an access token initally.

Make a POST request to https://www.placespeak.com/connect/token/ with the following POST data:

cURL example

This will return data in the same format as the original access_token request:

If you didn't save the refresh_token previously, your user will have to re-authorize your application manually, in order for you to get updated data.

Buttons

We have created some images to be used as buttons for PlaceSpeak Connect: