Hacker News Reader

You can use a subset of OAuth - I tend to use the so called "0-leg" version of OAuth, which is pretty much the same as a username/password (consumer key + secret), but with added benefits such as protection against replay attacks.

It's also pretty simple to implement on client side and server side. I usually give our clients a little library to get started with requests.

View on HN

I've implemented OAuth client-side a few times in a few languages. The signing process itself may not be that difficult to understand, but there are a lot of fiddly moving pieces, the specs are painful to read, and everyone has their own unique take on the spec.

I wouldn't call it simple. It's complex to get right, and outright damaging to non-web clients except in the case where xAuth or similar is available.

Honestly there is nothing simple about OAuth -- and the specs are horrible (even when you understand them).

Reply on news.ycombinator.com