From 2db956893c06a349a901096deecda846558f8fad Mon Sep 17 00:00:00 2001 From: pradeepkumar Date: Sat, 28 Mar 2026 17:03:27 +0530 Subject: [PATCH] feat: update Twitter auth to use confidential client flow with Basic authentication --- lib/core/services/twitter_auth_service.dart | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/core/services/twitter_auth_service.dart b/lib/core/services/twitter_auth_service.dart index 19dfe3e..16f525b 100644 --- a/lib/core/services/twitter_auth_service.dart +++ b/lib/core/services/twitter_auth_service.dart @@ -8,6 +8,7 @@ import 'package:real_estate_mobile/config/app_config.dart'; /// Twitter OAuth 2.0 PKCE flow for mobile. class TwitterAuthService { static const _clientId = 'eWEzaDJ0al9lX1diOGY0ejRYeXM6MTpjaQ'; + static const _clientSecret = 'HadGMSRKKswfXOajbmggrnmLAn9cxJsl8GtFxGHqjX-CJ0A2Tu'; static const _scope = 'tweet.read users.read offline.access'; /// Derive redirect URI from API base URL (matches next-auth callback) @@ -57,11 +58,11 @@ class TwitterAuthService { Future?> exchangeCodeForUser(String code) async { final dio = Dio(); - // Exchange code for access token (PKCE public client — client_id in body) + // Exchange code for access token (confidential client — Basic auth) + final credentials = base64Encode(utf8.encode('$_clientId:$_clientSecret')); final tokenBody = 'code=${Uri.encodeComponent(code)}' '&grant_type=authorization_code' - '&client_id=${Uri.encodeComponent(_clientId)}' '&redirect_uri=${Uri.encodeComponent(_redirectUri)}' '&code_verifier=${Uri.encodeComponent(_codeVerifier)}'; @@ -69,6 +70,9 @@ class TwitterAuthService { 'https://api.twitter.com/2/oauth2/token', options: Options( contentType: 'application/x-www-form-urlencoded', + headers: { + 'Authorization': 'Basic $credentials', + }, ), data: tokenBody, );