I wrote a simple twitter client for command-line use. For such application, twitter requires two types of tokens, namely
- application identification,
- user OAuth Token.
The second one is to allow the user to connect to their account, and the first one is in principle to identify the developper/application for twitter.
So far, I have distributed (well placed on github) only the code without any token. The User tokens is clear, it is up to the end-user to authorize the access to their account.
The problem that I have is for the application identification token. So far, I require that the end user register an application themselves, take that token, and use the code. I am afraid that having it directly available, people could take it, use it in another application and abuse the Twitter API. But that has a complexity cost for the end-user.
How should I share/organise the application identification that is both secure for the developper and simple for the user?