I am creating my first WordPress plugin. It is a Twitter plugin that uses Twitter API 1.1 and OAuth 2.0 to generate a bearer token and then use that to fetch Tweets from Twitter.
The plugin is almost ready to be launched.
Right now, the user of the plugin will need to go here: https://developer.twitter.com/en/apps/create and create a new app, filling in all details, so that they can generate their Consumer API key & secret to use with my plugin.
As soon as they do that, my plugin will fetch a bearer token for them. My plugin only needs "Read" permission.
I have seen many plugins do it this way. But it definitely seems like a very tedious step to follow for the user in order to use the plugin.
My questions are:
- Is it the right method?
- Is there a better way to approach this?
- Should I somehow, store my Consumer API key & secret details on my server? And any of my distributed plugins should automatically fetch it from my server?
- Further, are the Consumer API key & secret associated with my Twitter app, meant to be distributed with my Twitter plugins?
Answers to these questions would clear a lot of mystery for me around this topic.
Thanks in advance.