title: How are Twitter _app_ tokens stored, and when should I get new ones?
body: <p>(Using the node.js oAuth module)</p>
  
  <p>The flow for getting auth tokens from a user from all the examples I've seen is:</p>
  
  <ol>
  <li>Generate unique app auth token and secret using app ID and secret</li>
  <li>Save these to the user's session</li>
  <li>Use the retrieved app auth token to generate the user auth redirect URL</li>
  <li>User clicks authorize which sends the app a user token and secret</li>
  <li>Use the saved tokens and the new user tokens to post on the user's behalf</li>
  </ol>
  
  <p>(This is one code example I've found doing it as described: <a href="http://runnable.com/UTlPL1-f2W1TAAAV/how-to-oauth-with-twitter" rel="nofollow">http://runnable.com/UTlPL1-f2W1TAAAV/how-to-oauth-with-twitter</a>)</p>
  
  <p>What I don't understand is how Twitter stores the tokens retrieved in step 1. They're generated without any connection to users, and they appear to continue to work even after new ones are generated.</p>
  
  <p><strong>Example:</strong> User A goes through steps 1, 2, and 3, but then User B goes through steps 1, 2, and 3 before User A clicks authorize, yet both auths work with their original app tokens generated from step 1, despite the app auth tokens being recreated and different.</p>
  
  <p><strong>So three major questions from all this:</strong></p>
  
  <ul>
  <li><p>How long do the app tokens from step 1 last?</p></li>
  <li><p>Should I generate new app tokens (step 1) each time I then want to post on a user's behalf?</p></li>
  <li><p>Is there a simpler way to generate the redirect URL (step 3) or auth posts (step 5)? I know Facebook doesn't require you to generate app tokens for either, but I haven't found any way to do this with Twitter.</p></li>
  </ul>