Does OAuth always involve using a user interface?

Question

I would like to connect to LinkedIn and extract some information through their API. The LinkedIn API uses OAuth 2.0.

All the documentation I read about OAuth (both in the context of LinkedIn and in general) seems to suggest that there is a user interface in the form of a pop-up window that provides access.

However, in my case, I just want to export data through a command line application that will not have a user interface. What I'm really looking for is a simple authentication method, not authorization. Connection credentials will be in the configuration file.

Is OAuth what I want / need, or am I really looking for something else?

Answer 1

Is OAuth what I want / need, or am I really looking for something else?

It depends on the API with which you mostly interact. It seems that LinkedIn only works with OAuth2 (and 1, but it is deprecated). Therefore, you have no other options.

OAuth is designed with delegation in mind. Who owns the information you want to extract from LinkedIn? The purpose of the user interface stream is for the data owner to agree to provide it to a third party (your application). Often with a specific scope (e.g. access to a profile, network, contacts, etc.). The owner of the information authenticates and permits the disclosure of information to a third party (your application). Your application is also authenticated for LinkedIn (as a registered application), and then you call the API.

refresh_tokens is a tool for requesting new tokens without asking the user for any consent each time. These are relatively durable objects that can be saved (and can be canceled by the user at any time).

If this is your data (you are both the owner and the third-party application), you can start the command line process with the initial authentication / authorization, and then you save it with access_token/refresh_token until the update token expires.

Some system (most likely LinkedIn) supports what is called a resource owner stream . In which you can get access_token through credentials (user / password). But no one is likely to give up their credentials in your application. (The exception is that both of you, as I wrote above).