Is it OK to save Twitter passwords for easy login via the Twitter API?

Question

I'm writing a tool in our web app to allow our users to tweet certain things about our app via the Twitter API. In all the documentation I've seen the Twitter API has you submit the user's username and password via XML or JSON. It would make sense from a usability standpoint to save the username and password for easy reuse (so they don't have to log in everytime they tweet. Although I want to make sure we are allowed to do this before we actually implement the saved username/passwords.

Does anyone know if there are any laws that prevent us from doing this? Is this just what Twitter expects us to do?

Answer 1

While you can certainly store people's usernames and passwords for use with the Twitter API, this is not the recommended approach. Try Twitter's OAuth Authentication instead.

OAuth is an authentication protocol that allows users to approve applications to act on their behalf without sharing their password.

Twitter will eventually deprecate basic (username/password) authentication in the future. Mid-2010 is likely.

Answer 2

I would stick with OAuth, the reason OAuth is beneficial is your site > will no longer need to handle Twitter passwords, store them, protect them, and deal with the legal consequences (Can't link because the work proxy blocks The Twitter wiki lol). Keyword: Legal. Don't store them.

Answer 3

I didn't find anything answering this question one way or the other in the Twitter T&C. In other words, it doesn't seem to be explicitly forbidden, as it is, for example, at Facebook.

But it's clearly undesirable to store other people's usernames and passwords to proxy for them.