I noticed that if you have a 3rd-party Twitter app, you get an access token, and an access token secret, to communicate with Twitter.
Why are there two codes? Shouldn't one be enough?
Does this mean every 3rd-party app needs to have their own server that adds the token secret to the request? (Because if it were stored in the app itself, it could be decompiled and the secret revealed?)