Being browser based, a web application or service is able to use the full web-based OAuth process which means the user has the smoothest of the authentication methods.

To authenticate your web application with Twitter you must use OAuth. Requests to use xAuth will be declined.

Web applications often support multiple users so it is important you manage the association of OAuth tokens to user identities carefully. The way you do this will be dependent on your application and setup.

Third party applications such as Twitpic and yfrog will also use OAuth to communicate with the Twitter API. For anyone developer wishing to incorporate or offer a service similar to these applications this presents some challenges.

Suitably there is a way to securely delegate requests to the Twitter API on an application and users behalf known as OAuth Echo.

OAuth Echo allows you to prepare an OAuth request and then send it to the third party service who, after completing any operations they need to do, echo your OAuth request to the Twitter API.

Mobile and Desktop applications are most often single user applications such as command line scripts and applications on a phone. For these applications it can be difficult to handle a callback URL if not impossible.

If you can handle a callback in your application we strongly encourage you use OAuth to authorize users. If not you should consider Out-of-band/PIN code authentication

For applications that really can't handle the full OAuth process Twitter provides the out-of-band/PIN code authentication mode, also known as oob.

This authentication flow is almost identical to full OAuth except instead of being directed back to your website the user is presented with a PIN code. The user is then asked to type this PIN code into your application which will then complete the token exchange.

In the full OAuth flow this manual process is performed by the callback URL and transparently to the end user.

The least desired way to authenticate with Twitter is xAuth. This method is only available to desktop or mobile applications and you need to request permission to use it. Also, to avoid confusion you need to be clear that xAuth for Twitter is not the same as the XAuth (note the change in letter case).

It is important to understand that xAuth is still OAuth. The only difference being that you skip the request_token and authorize steps of the OAuth flow.

xAuth is not a simple replacement for basic authentication and still requires you understand how to sign your requests.

If you still want to use xAuth you can read more about how to request access and make xAuth calls on our using xAuth page.