Skip to content

sources/oauth/twitter: update fields, scopes and profile URL to match current X API #18670

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
muien5080 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

sources/oauth/twitter: update fields, scopes and profile URL to match current X API #18670

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0141c1f
Fix Twitter OAuth2 fields and scopes
muien5080 Dec 8, 2025
f578f7d
Fix Twitter OAuth integration: add users.email scope, include id fiel…
muien5080 Dec 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 17 additions & 3 deletions authentik/sources/oauth/types/twitter.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,18 @@ class TwitterOAuthRedirect(OAuthRedirect):
"""Twitter OAuth2 Redirect"""

def get_additional_parameters(self, source): # pragma: no cover
scopes = ["users.read", "tweet.read"]
Copy link

@sayah-y sayah-y Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to this doc, to get the email, we must add the following scope: users.email

# If admin has defined custom scopes in the provider UI, merge them
configured = getattr(source, "scope", []) or []
for s in configured:
if s not in scopes:
scopes.append(s)
return {
"scope": ["users.read", "tweet.read"],
"scope": scopes,
}



class TwitterOAuthCallback(OAuthCallback):
"""Twitter OAuth2 Callback"""

Expand All @@ -40,13 +47,20 @@ class TwitterType(SourceType):

authorization_url = "https://twitter.com/i/oauth2/authorize"
access_token_url = "https://api.twitter.com/2/oauth2/token" # nosec
profile_url = "https://api.twitter.com/2/users/me"
profile_url = "https://api.twitter.com/2/users/me?user.fields=verified,username,name,profile_image_url,confirmed_email"
Copy link

@sayah-y sayah-y Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to this doc, fields id, name and username are marked as default (always included).
I think it's better to specify them not to depends on the X Api changes. But in this case, id is missing.
It will give:
profile_url = "https://api.twitter.com/2/users/me?user.fields=id,name,username,confirmed_email,profile_image_url,verified"


pkce = PKCEMethod.S256

def get_base_user_properties(self, info: dict[str, Any], **kwargs) -> dict[str, Any]:
data = info.get("data", {})
email = (
data.get("confirmed_email")
or data.get("email")
Copy link

@sayah-y sayah-y Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we can delete this line because this doc tells thats this field is named confirmed_email, no need to check for an alternative name.

or None
)
return {
"username": data.get("username"),
"email": None,
"email": email,
"name": data.get("name"),
}