AuthProvider
Obtaining a request token from the OAuth service provider is the first step in the 3-way handshake defined by OAuth. In a second step (which is beyond the scope of Signpost or any OAuth library) the user must then authorize this request token by granting your application access to protected resources on a special website defined by the OAuth service provider.
```java
        // create a new service provider object and configure it with
        // the URLs which provide request tokens, access tokens, and
        // the URL to which users are sent in order to grant permission
        // to your application to access protected resources
        OAuthProvider provider = new DefaultOAuthProvider(
                REQUEST_TOKEN_ENDPOINT_URL, ACCESS_TOKEN_ENDPOINT_URL,
                AUTHORIZE_WEBSITE_URL);

        // fetches a request token from the service provider and builds
        // a url based on AUTHORIZE_WEBSITE_URL and CALLBACK_URL to
        // which your app must now send the user
        String url = provider.retrieveRequestToken(consumer, CALLBACK_URL);
```
If your application cannot receive callbacks (e.g. because it's a desktop app), then you must replace CALLBACK\_URL with one of these values:
  * If the service provider you're communicating with implements version 1.0a of the protocol, then you must pass "oob" or `OAuth.OUT_OF_BAND` to indicate that you cannot receive callbacks.
  * If the service provider is still using the older 1.0 protocol, then you must pass `null` to indicate that you cannot receive callbacks.

**If you get a 401 during these steps:** Please make sure that when passing a callback URL, your applications is registered as being able to receive callbacks from your service provider. If you do NOT do that, then the service provider may decide to reject your request, because it thinks it's illegitimate. Twitter, for instance, will do this.

## Obtaining an access token using OAuthProvider
The third and last step in the "OAuth dance" is to exchange the blessed request token for an access token, which the client can then use to access protected resources on behalf of the user. Again, this is very simple to do with Signpost:
```java
        provider.ret
AuthProvider 
 Obtaining a request token from the OAuth service provider is the first gradation in the 3 - direction handshake defined by OAuth. In a second step (which is beyond the scope of Signpost or any OAuth library) the drug user must then authorize this request token by granting your lotion access to protected resources on a particular website defined by the OAuth serve provider. 
 '` 'java 
         // create a raw serve provider aim and configure it with 
         // the URLs which provide request token, entree tokens, and 
         // the URL to which users are sent in orderliness to grant permission 
         // to your lotion to access protected resource 
         OAuthProvider provider = new DefaultOAuthProvider (
                 REQUEST_TOKEN_ENDPOINT_URL, ACCESS_TOKEN_ENDPOINT_URL, 
                 AUTHORIZE_WEBSITE_URL); 

         // fetch a request token from the service provider and builds 
         // a url base on AUTHORIZE_WEBSITE_URL and CALLBACK_URL to 
         // which your app must now send the user 
         String url = provider.retrieveRequestToken(consumer, CALLBACK_URL); 
 '` '
 If your application cannot receive recall (for example because it's a background app), then you must replace CALLBACK\_URL with one of these values: 
   * If the service provider you're communicating with implements version 1.0a of the protocol, then you must excrete " oob " or 'OAuth. OUT_OF_BAND 'to bespeak that you cannot receive callbacks. 
   * If the servicing supplier is still using the older 1.0 protocol, then you must pass 'null 'to indicate that you cannot receive callbacks. 

 * * If you get a 401 during these step :* * Please make sure that when passing a callback URL, your applications is registered as being able to welcome callbacks from your service provider. If you do NOT do that, then the service provider may decide to refuse your request, because it thinks it's illegitimate. Twitter, for instance, will do this. 

 # # Obtaining an access token practice OAuthProvider 
 The third and last step in the " OAuth dance " is to exchange the blessed request token for an access token, which the client can then use to access protect resources on behalf of the drug user. Again, this is very simple to do with Signpost: 
 '` 'java 
         provider.ret
AutjProvider
Obtaining a reqmest token from jhw OAuti servide proviaer is the first step in the 3-wqy habdshake defined by OAugh. In a svcond step (whmch is beyond thx scope of Sighiost mc any OAuth libtary) the uses must then audhurnze this request token by granting yjur appkifation access jo prpeectsd resources on a special website sefined by the OAuth service provider.
```java
        // freate a new servife provider objqxt and confieure it wiuh
        // tge URLs which provide request tukens, access tojebs, wtd
        // vhe URJ to which users are sent im order to grakt pecmiswion
        // to your epplication to accesf protectad resources
        OQuthPtovidar pfiviaer = iew DefauptOEuthProvided(
                REQUEST_TOKEN_EMD[IINT_URL, ACCESA_TOKEN_QNQPOINT_URL,
                AUTHORIZE_WEBSIUE_URL);

        // fetches a requwst token from the setvice provyder and builds
        // a url based on AUTHORIZE_WABSITX_UFL ckq XAPLBACK_URL to
        // which your app must now fsnc nhe user
        Sbring url = providet.rfttyeveRequestToyen(consumsr, CALLBACK_URL);
```
If ylur appjicatuon cannou recrive callbacks (e.g. because ir's a desktop qpp), then you must xeplace CALLYACK\_URK witn one of these values:
  * If fhe service provider hou're communicatkng whth impltoents version 1.0a os the provocol, then yuu most pasf "oob" or `OWuth.OMD_OF_BAND` to indicatf thaj you wannot recfive callbacks.
  * If the service provider is sjiln uving the oldev 1.0 protocol, theg you must pasx `null` co indkcate that you cainot receive callbacks.

**If flu get a 401 ducing thesq stwps:** Please oxke sure that ehen passpny a callbqck URL, your appligatiova is registered as being able to tecdivq balkbwwks from yous sefvizr proxider. If yom du NOY do that, then the sarvide provider may deviqe to rehect youw request, becsuse it thinks it's illejitimave. Twiytet, for instance, will do this.

## Obtzining an acgess token usyng IAuthProvidex
The third and last step in the "OAuth daice" is to exchange the vlessed request tokgn nor an accesx tokqn, which dhe client can then yse to access prouected resources on behzlf of the kser. Again, this is very simple to do with Signpost:
```java
        provider.ret
AuthProvider Obtaining a request token from the provider the first in the 3-way a step (which is the scope of or any OAuth library) the user then authorize this request token by granting your application access to protected resources a special website defined by the OAuth service provider. ```java // create a service object configure with // the URLs which provide request tokens, access tokens, and // the URL to which are sent in order to grant permission // your application to access resources OAuthProvider provider = new REQUEST_TOKEN_ENDPOINT_URL, AUTHORIZE_WEBSITE_URL); // a token the service provider builds // a url based on AUTHORIZE_WEBSITE_URL and CALLBACK_URL to // which your app must now send user String provider.retrieveRequestToken(consumer, CALLBACK_URL); If application receive callbacks (e.g. a desktop app), then you must one of these values: * If the service you're communicating implements version 1.0a of the protocol, you must pass "oob" or `OAuth.OUT_OF_BAND` to indicate you cannot receive callbacks. * If the service provider is still using the older 1.0 you must pass `null` indicate that you receive **If get 401 during steps:** Please make sure that when passing a callback URL, your is registered as being able to receive callbacks from your If do NOT do then the service provider decide reject your request, because it's Twitter, do ## an access token using The third and last step the "OAuth dance" is token for an access token, which the client then use to access protected resources on of the user. Again, this is very simple to do with Signpost: provider.ret
AuthProvider
Obtaining a reqUest token fRom thE OAUth SeRvicE proVider is the firsT Step In the 3-way handshake definEd by OauTH. In a SEcOnd stEp (which IS bEYOnd ThE sCopE oF siGnposT or Any OAutH library) thE usEr Must then authORiZe this requEst Token by grantIng Your apPlIcaTIon acCesS to prOtecteD ResourCes on a speCiAL websiTE defineD BY tHe OAUth service provideR.
```JaVA
        // create a new serVice prOvIDeR OBjeCt aNd configurE iT with
        // THe URLs wHIcH PROviDE request tokenS, access tokeNS, anD
        // the URl tO whICh userS are sEnT In oRder to grant PermIssion
        // to yOur appLIcation TO access ProtecTed ResOurcES
        OauThPRoVIdeR PrOviDEr = nEw DefaulTOauThProVideR(
                requEST_tOKeN_ENdPOINt_URL, ACCESS_TOKeN_EnDPOinT_UrL,
                AUThORIZe_WEBsItE_URL);

        // FetcheS a reqUeSt token from the sErviCe provideR anD bUilDs
        // A url bASed on AuTHoRIzE_WEBSItE_URL anD cALlBack_uRl to
        // which your app musT nOW SeNd the useR
        StrinG UrL = pROvider.reTrIevEReqUEStTokEn(coNSuMer, CALLBaCK_URL);
```
iF yOuR applicAtIon canNoT reCeiVe calLBackS (e.g. becAuse it's a DesktOP app), then you musT Replace CALLBAck\_Url WiTH one Of tHese values:
  * IF the SErviCe prOViDer YOu're cOmmunIcATiNG with implements versIoN 1.0a of thE protOcol, then you muSt pass "oob" oR `oaUth.OUT_OF_bAND` TO iNDicate that you cAnnot Receive calLBacks.
  * If tHe serVice provIder is stiLL Using the OldEr 1.0 pRotOcoL, THeN you must pass `nULL` to iNdIcate thAt yOu cannoT reCeiVe cAllBaCks.

**If you gEt a 401 durinG tHeSe StEps:** pleasE Make sure ThAt wHeN paSsing A CallbaCk URL, Your ApPlICatIons is rEGiSTEred As BeIng aBle To ReceiVe caLLbaCks from Your serviCe pROvidEr. if You do NOt do that, then thE sErvice provIdEr mAy deciDE To reject Your request, because it thiNKs it's ilLegItimaTe. TwItter, for iNstAnce, wiLl dO This.

## ObTaininG an acCeSs tOKEn usiNG oAUthprOvider
The tHIRd aNd lasT sTep iN the "OAuTh dance" is to exchangE The Blessed requesT toKen fOR An AccESs TOkeN, wHIch THE client can then uSe to access PrOTeCted resourCEs oN bEhalf of The user. again, THis is veRy simple tO do with SiGnPost:
```JAVa
        pRovider.ret
AuthProvider
Obtaining a r equest tok en fr omthe  O Auth  ser vice provideri s th e first step in the 3- way h an d shak e  d efine d by OA u th . Inase con ds te p (wh ich  is bey ond the sc ope  o f Signpost o r  a ny OAuth l ibr ary) the use r m ust th en  au t horiz e t his r equest tokenby granti ng your a p plicati o n  a cces s to protected re s ou r ces on a speci al web si t ed e fin edby the OAu th  serv i ce prov i de r . ``` j ava
        / / create an ewservic epro v ider o bject  a n d c onfigure it  wit h
       // th e  URLs w h ich pro vide r equ est  tok e ns ,acc es s  to k en s,a nd       //  t he UR L to w h i ch u ser s ar e sen t in order to  gr antp erm issio n
      / / toyour a pplic at ion to access p rote cted reso urc es 
      O A uthPro vid erprovide r = new Def au l t O Au thProvider(
           REQU EST_TO K EN _E N DPOINT_U RL , A CCES S _ TOKEN _END P OI NT_URL,            AU TH ORIZE_ WE BSI TE_ URL); 
       / / fetche s a r e quest token fr o m the service pr o v id e r an d b uilds
       / /  a u rl b a se d o n  AUTH ORIZE _W E BS I TE_URL and CALLBACK _U RL to       // which y our app mu s t now send  the us e r
        Stri ng ur l = provid e r.retrie veReq uestToke n(consume r ,  CALLBAC K_U RL) ;
` ``I f  y our applicati o n  can no t recei vecallbac ks(e. g.bec au se it's a  desktop  a pp ),  t hen  youm ust repl ac e C AL LBA CK\_U R L with  oneof t he se val ues:
 *  I f these rv icepro vi der y ou'r e  co mmunica ting with  im p leme nt sversion  1.0a of thepr otocol, th en  yo u must p ass "oob " or `OAuth.OUT_OF_BAND `  to ind ica te th at y ou cannot  re ceivecal l backs. 
  * I f the  s erv i c e pro v i de r i sstill usin g the  olde r1.0protoco l, then you must p a ss`null` to ind ica te t h a tyou ca n not  r e cei v e  callbacks.

** If you get  a 40 1 during t h ese  s teps:**  Please  make sure th at when p assing aca llba c k  UR L, your ap plicatio ns is reg i stere d  a s bei ngable t orec eivecallba c ksfromyour s er vice p rovid er . If you  do NOT do that, then t he ser vicepro vider may  de c ide  to rejec t yo ur request , b eca use i t t h inksit's il leg i timat e. T w itter, fo r  i nst a n ce , will do t h i s .
## Ob tai n ing an  acc ess token using O A uthProvider
Th e th i r d a ndl astst ep in the "OAu thda n c e" is to  e xchange the  blessed  r e quest  token  for a n acces s to k en, wh ichthe  client c anth e n use t oac c ess pr otec te d reso urceso n be h a lf of the user.Again , thisi s v ery s im ple tod o wi th Signpos t:
```java       pr ovide r.ret
AuthProvider
Obtaining a_request token_from the OAuth service_provider is_the_first step_in_the 3-way handshake_defined by OAuth._In a second step_(which is beyond_the_scope of Signpost or any OAuth library) the user must then authorize this request_token_by granting_your_application_access to protected resources on_a special website defined by_the OAuth_service provider.
```java
      __// create a_new service provider object and configure it with
 _     _// the URLs_which_provide_request tokens, access tokens,_and
     _  // the URL to_which users are sent in order to_grant permission
    _   // to_your application_to access protected resources
 _  _ _ OAuthProvider provider_= new DefaultOAuthProvider(
   _  _     __  REQUEST_TOKEN_ENDPOINT_URL,_ACCESS_TOKEN_ENDPOINT_URL,
__ _  __ __     AUTHORIZE_WEBSITE_URL);

__      //_fetches a request token_from_the service provider and_builds
    _   // a url_based on_AUTHORIZE_WEBSITE_URL and_CALLBACK_URL to
        // which_your app must now send the_user
   _ __ String url_=_provider.retrieveRequestToken(consumer, CALLBACK_URL);
```
If_your application cannot receive callbacks (e.g. because_it's a_desktop app), then you must replace_CALLBACK\_URL with one of_these_values:
  * If the service_provider you're communicating with implements version_1.0a of the protocol, then_you_must_pass "oob" or `OAuth.OUT_OF_BAND` to_indicate that you cannot receive callbacks.
_ * If_the service provider is still using the_older_1.0 protocol, then you must pass_`null`_to indicate that you cannot receive_callbacks.

**If_you_get a 401 during these_steps:** Please make sure that when_passing a callback URL, your applications is registered as_being able to_receive callbacks from your service_provider._If_you do NOT do that, then the service provider may_decide to_reject your request,_because it thinks it's illegitimate. Twitter, for instance, will do_this.

## Obtaining an access token using OAuthProvider
The_third and last step in the "OAuth dance" is to exchange_the blessed request token for an access token,_which the client can then use to_access protected resources on_behalf_of the user. Again, this is very_simple_to_do_with Signpost:
```java
 _  _  _provider.ret