Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our clients need to authorize our partners to release data to us. We can collect this data via a push/pull mechanism. Since our partners have never shared data before, they don't have OAuth implemented.

What is the best way for clients to tell their service providers (our partners) to release data to us without having each partner bear the overhead of implement OAuth. Is there a standard practice for this sort of an authorization? Thanks!

share|improve this question
Why would you want to do without OAuth? It has been developed specifically for this use case. Implementing it and offering it as a secure way for their users to allow others access to their data should be a very interesting selling point/feature as it means users won't have to proliferate their user/password all over the place. – Marjan Venema May 13 '12 at 10:00
A bit too vague - what kind of data are you talking about? – Oded May 13 '12 at 10:00
This is personal information that our partners collect. Traditionally this data hasn't been shared. Some partners don't have enough customers to justify spending resources on implementing OAuth. While I agree OAuth is the right option for this case, we have several thousand partners and it's going to take some work to convince/help each one to implement OAuth. In addition, clients don't have login credentials as they don't have to interact with our partner after they sign-up with them. – theoutlander May 14 '12 at 9:52
Is it a one-time data pull or will you constantly need to be retrieving information from your partners? – Joe Nov 22 '13 at 20:14
"standard practice for this sort of an authorization" sounds exactly like "OAuth" to me. I can't imagine anything robust that would be any harder to implement, especially since there are bound to be existing OAuth implementations you can use. I think the closest you can get to not requiring them to implement OAuth is for you to prepare a program for them to run on their machines. Whether they'd go for that I have no idea. – Ixrec Dec 26 '15 at 16:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.