Khan Academy OAuth Discusson

Matt Green

01:44

Hello there, thanks so much for the help! I'm new to OAuth and just getting beyond novice level with Wolfram Language. I'm not sure where to go from here...

I'm uncertain about the token & token secret... I think the values I used (and you used) are examples in the Khan API docs... I'm guessing you referenced the line: oauth_token=t4632213944267176&oauth_token_secret=4tsVQH6L5n2TGm8R

Shouldn't those be given to me after I initiate the connection?

Matt Green

02:19

I tried running it without the token and token secret parameters and it failed...

b3m2a1

02:51

@MattGreen Ah sorry went off to clean the house and didn't see this. Ping me by using @b3m2a1. With OAuth you'll get the token and token secret after a first call to the API auth page, after your user authenticates, generally.

So to start try something like this:

OAuthSigning`Private`HMACSha1SignatureService[
"http://www.khanacademy.org/api/auth2/request_token",
"HMAC",
"POST",
"7cPJxRmA5ybuaNQz",
"superSecret",
"",
""
]

Then you send them to the authorize endpoint (khanacademy.org/api/auth2/authorize) with the request_token and get back the oauth_token and oauth_token_secret. You generally need to have the user copy them in via prompt, although in the OAuth framework there seems to be some effort towards doing it via the ChannelFramework and I may implement something of my own for that.

Generally though I tend to write HTML pages that pull it the keys in Javascript and display them on the page, telling them to copy it into Mathematica (and giving them a prompt to)

Well the ServiceConnect framework provides the prompt, but the pages are my own. I'd suggest making a page and putting it in the cloud using CloudExport and passing that as your callback_url.

Then in the last step you use the token and token secret:

OAuthSigning`Private`HMACSha1SignatureService[
"http://www.khanacademy.org/api/auth2/access_token",
"HMAC",
"GET",
"7cPJxRmA5ybuaNQz",
"superSecret",
"oauth_token",
"oauth_token_secret"
]

Or something like that

If that all works I'll post it as an answer

Matt Green

16:47

@b3m2a1 Hello @b3m2a1, I tried this and received another Invalid Signature error

Ha! I changed the method from POST to GET and it worked! Boom! now I'm on to trying to use the token and token secret!

b3m2a1

18:14

@MattGreen the core issue in your post as I saw it updated is that you actually have to send someone to the Khan Academy website. Now that we know you can get the request token and whatever like that I'll put in a quick update on the answer.

Matt Green

18:40

Thanks @b3m2a1. I'm attempting to do this (from: github.com/Khan/khan-api/wiki/Khan-Academy-API-Authentication)

Alternative: logging in directly with your own account
If you are logging in as yourself (that is, the KA user who registered the API key), then you have the option to skip the browser-based approval step and approve the token directly by making a POST request with your KA credentials. This makes it easier to log in automatically without manual steps.

To do this, send a POST request to https://www.khanacademy.org/api/auth2/authorize with the following parameters in the POST body:

oauth_token (required) - The request token.

I'm attempting to build the string manually (without signing) the link I generate allows me to login via the browser but in Mathematica via URLExecute[] it won't return anything...

authURL = "http://www.khanacademy.org/api/auth2/authorize";
tokenString = requestToken[[4]];
id = "myID";
pass = "myPass";
loginURL =
StringJoin[{authURL, "?oauth_token=", tokenString, "&identifier=",
id, "&password=", pass}]
res = URLExecute[loginURL];

b3m2a1

Have you been able to get a request token and request token secret?

@MattGreen because once you have those you simply send them to the auth URL, you can't use URLExecute on it I think.

And then it's returned in the URL hash no doubt

I can knock up a sample callback_url page for you to use to get the responses

Matt Green

19:01

Yes @b3m2a1, I can get the request token and secret. I have been trying to send them to the auth URL but I'm having trouble putting the string together. I'm not sure how to specify the method as POST. I also don't understand the callback_url purpose. Can you link me something I could read to learn more?

b3m2a1

The callback_url is where the user is sent after authenticating

Try this:

wolframcloud.com/objects/… _secret

Ugh. Misformatted

Try this:

"https://www.wolframcloud.com/objects/user-affd7b1c-ecb6-4ccc-8cc4-4d107e2bf04a/‌o/oauthflow/oauth2callback-request_token-request_token _secret"

@MattGreen sorry about the formatting. Things always go weird on chat. Try this:

"https://www.wolframcloud.com/objects/b3m2a1/o/oauthflow/\
oauth2callback-request_token-request_token_secret" // SystemOpen

That's a callback_url you can pass and the person will be routed there. It finds the parameters in the query string and inserts them into the page.

Or rather what would be more useful for you is this one:

"https://www.wolframcloud.com/objects/user-affd7b1c-ecb6-4ccc-8cc4-\
4d107e2bf04a/o/oauthflow/oauth2callback-access_token"

@MattGreen try this:

OAuthDialogDump`Private`MultipleKeyDialog[
 "Khan Academy",
 {
  "Access Token" -> "access_token"
  },
 URLBuild@
  <|
   "Scheme" -> "http",
   "Domain" -> "www.khanacademy.org",
   "Path" -> {"", "api", "auth2", "authorize"},
   "Query" -> {
     "oauth_token" -> $oauthtoken,
     "oauth_callback" -> oauthcallbackurl
     }
   |>,
 None
 ]

where $oauthtoken is the token you got before

And `oauthcalbackurl` is optional, but you can try `"https://www.wolframcloud.com/objects/user-affd7b1c-ecb6-4ccc-8cc4-\
4d107e2bf04a/o/oauthflow/oauth2callback-access_token"`

"https://www.wolframcloud.com/objects/user-affd7b1c-ecb6-4ccc-8cc4-\
4d107e2bf04a/o/oauthflow/oauth2callback-access_token"

Sorry

@MattGreen oh reading the Khan Academy docs they use some weirdo format with oauth_verifier

(Or maybe oauth 1.0 is just weird. In any case it's clunkier thant 2.0)

Whatever you'll want this callback URL:

"https://www.wolframcloud.com/objects/user-affd7b1c-ecb6-4ccc-8cc4-\
4d107e2bf04a/o/oauthflow/oauth2callback-oauth_verifier"

Matt Green

19:16

Great! I'll try soon. A question: how do I know my data is safe if it's being passed through the callback you wrote? I hope that question makes sense. Will you share the code you wrote to generate that callbackurl?

b3m2a1

And replace "Access Token" -> "access_token" with "OAuth Verifier" -> "oauth_verifier"

Hah, yeah of course. One sec.

Or better yet, go to the page and check the page source. It's just JS operating in the browser.

Or go here:

view-source:wolframcloud.com/objects/…

Blech

view-source:https://www.wolframcloud.com/objects/user-affd7b1c-ecb6-4ccc-8cc4-4‌d107e2bf04a/o/oauthflow/oauth2callback-oauth_verifier

The actual code itself I'm gonna post in the answer if this all works out.

It's a bit big and clunky

(view-source may only work in Chrome--I don't really know)

@MattGreen fixed some of the JS so that it actually appears. Basically I build the static page programmatically then CloudExport.

Matt Green

19:33

I ran this

OAuthDialogDump`Private`MultipleKeyDialog["Khan Academy", {"OAuth \
Verifier" -> "oauth_verifier"},
URLBuild@<|"Scheme" -> "http", "Domain" -> "www.khanacademy.org",
"Path" -> {"", "api", "auth2", "authorize"},
"Query" -> {"oauth_token" -> requestToken[[4]],
"oauth_callback" ->
"https://www.wolframcloud.com/objects/user-affd7b1c-ecb6-4ccc-\
8cc4-4d107e2bf04a/o/oauthflow/oauth2callback-access_token"}|>, None]

and it returned the output as a string. I'm guessing I need to include another Needs[] statement?

b3m2a1

Use <<OAuth`

That's in an OAuth package that needs to be loaded. Unfortunately Needs doesn't help with OAuth` .

b3m2a1

19:57

@MattGreen were you able to get that to work?

Matt Green

20:29

We just left the house for family time. I'm at least 5 hours away from trying it out. I'll report back when I get the chance =)

@b3m2a1

Transcript for

Khan Academy OAuth Discusson