Sending Tweets with Images Using iOS Shortcuts and OAuth 1.0a Authentication

This guide explains how to use iOS Shortcuts to send tweets with images via the Twitter API using OAuth 1.0a authentication. By integrating a Vercel API to handle HMAC-SHA1 signature generation, we can simplify the process of authenticating API requests. This article focuses on:

1. The step-by-step workflow in Shortcuts.
2. Proper request formatting for both the media upload endpoint and the main post endpoint.

---

Workflow Overview

To send a tweet with an image, the process involves two main steps:

1. Upload the image to Twitter's media library and retrieve a media_id.
2. Post the tweet with the media_id and text content.

To authenticate requests, a Vercel API is used to generate OAuth 1.0a signatures, allowing Shortcuts to focus on managing inputs and calling Twitter’s API.

---

Prerequisites

1. Twitter Developer Account: Ensure your app is set up with API keys, tokens, and proper permissions.
2. Vercel API: Deploy a Node.js API for HMAC-SHA1 signature generation (explained later).
3. Shortcuts App: Pre-installed on iOS devices.

---

Shortcut Workflow: Step-by-Step Guide

1. Choose and Encode the Image

1. Add the "Select Photo" action to allow users to pick an image from their photo library.
2. Use the "Base64 Encode" action to convert the selected image to a Base64 string. Twitter's media upload API requires the image in this format.

---

2. Upload the Image to Twitter

To upload the image and retrieve a media_id, configure the following API call:

Endpoint:

https://upload.twitter.com/1.1/media/upload.json

Request Configuration in Shortcuts:

• HTTP Method: POST
• Headers:
  • Content-Type: application/x-www-form-urlencoded
  • Authorization: Use a signature generated by the Vercel API.
• Body:

  media_data=Base64String

In Shortcuts, replace Base64String with the output of the previous encoding step. Once this request is made, parse the JSON response to extract the media_id.

---

3. Generate OAuth Signature Using Vercel API

Create a Vercel API that computes the OAuth 1.0a signature using HMAC-SHA1. This API should accept parameters like url, method, and body, and return:

• oauth_timestamp (ts)
• oauth_nonce
• oauth_signature

Example Request to Vercel API:

POST https://your-vercel-api-url.com/generate-signature

{
  "url": "https://api.twitter.com/2/tweets",
  "method": "POST",
  "body": "{"media_ids":"media_id","text":"Hello, world!"}"
}

Example Response:

{
  "ts": "timestamp_here",
  "nonce": "random_nonce_here",
  "signature": "generated_signature_here"
}

---

4. Construct the Authorization Header

Using the values returned by the Vercel API, construct the OAuth 1.0a Authorization header. Use the following format:

Authorization: OAuth 
  oauth_consumer_key="YOUR_CONSUMER_KEY", 
  oauth_token="YOUR_ACCESS_TOKEN", 
  oauth_signature_method="HMAC-SHA1", 
  oauth_timestamp="ts_value", 
  oauth_nonce="nonce_value", 
  oauth_version="1.0", 
  oauth_signature="signature_value"

Store this header in a Shortcut variable (e.g., OAuth_Header) for the final API call.

---

5. Post the Tweet with Media

With the media_id and the constructed Authorization header, send the final request to publish the tweet.

Endpoint:

https://api.twitter.com/2/tweets

Request Configuration in Shortcuts:

• HTTP Method: POST
• Headers:
  • Content-Type: application/json
  • Authorization: Use the OAuth_Header variable created earlier.
• Body:

  {
    "text": "Hello, world!",
    "media_ids": ["media_id"]
  }

Replace media_id with the value retrieved from the media upload step.

---

Summary of Workflow in Shortcuts

1. Select Photo: Allow the user to choose an image.
2. Base64 Encode: Convert the selected image to Base64 format.
3. Upload Image: Call the Twitter media upload API to get a media_id.
4. Generate OAuth Signature: Use the Vercel API to get ts, nonce, and signature.
5. Construct Header: Build the OAuth Authorization header.
6. Send Tweet: Post the tweet with text and media.

---

Notes on Request Formatting

Media Upload Request

• Endpoint: https://upload.twitter.com/1.1/media/upload.json
• Body Format: x-www-form-urlencoded
• Key: media_data

Post Tweet Request

• Endpoint: https://api.twitter.com/2/tweets
• Body Format: application/json
• Keys:
  • text: The tweet content.
  • media_ids: An array of uploaded media IDs.

---

Advantages of This Approach

• Simplified Workflow: By delegating signature computation to a Vercel API, you avoid handling complex HMAC-SHA1 logic in Shortcuts.
• Customizability: You can easily adapt this workflow for other Twitter API endpoints.
• Native iOS Experience: Shortcuts provides a user-friendly interface for sending tweets without third-party apps.

By following this guide, you can seamlessly tweet images via iOS Shortcuts while adhering to Twitter’s authentication requirements.