Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn.

When the book club becomes popular, we discover that 3rd party apps want to read data from our database. We store things like: the list of books each person has read, the queue, and what they thought of each book. The third parties (Amazon, Barnes and Noble, etc) want to read that data, under the context of the logged in user.


  • How should I design the OAuth login scheme for my website?
  • Can I rely on 3rd parties? (Google, twitter, anyone else?)
  • Once logged in, how can I share a subset of my data with 3rd party apps

  • Is the only way I can achieve this is if the IDP (Google or Yahoo) adds support for this (say in OAuth 3)?

share|improve this question
Have you been able to find a solution to this problem? It seems I'm getting in the same situation, opening up an api to potential third party developers, but at the same time relying on oauth providers like facebook, google. – Tobias Wormstaedt Apr 1 at 1:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.