Switch to OAuth2.0

[Solomon1732]

OSM is supporting version 2.0; version 1.0a is considered legacy. The only place I see two versions being mentioned is in #1161 in this comment.

[matkoniecz]

Can you link any info that 1.0a is deprecated and should be avoided?

I remember that there was something complicated about this

[matkoniecz]

any new application

Is there any indication made by sysadmins/maintainers of OSM website that existing software should be rewritten?

(StreetComplete uses plenty of deprecated things, for example in Android realm: and many are not worth spending effort to replace or are impossible to replace for now)

[Solomon1732]

Not that I can tell

[mmd-osm]

See openstreetmap/openstreetmap-website#3299 (comment)

So yes, you should start looking into OAuth 2.0 in the near future. No exact dates, but there are for sure plans to retire OAuth 1.0a at one point.

By the way, Basic Authentication is another candidate on the list for removal at some point in the future (also no exact dates defined yet).

[matkoniecz]

@Solomon1732 Can you tell me how you checked that SC is using OAuth1?

[mmd-osm]

SC uses https://github.com/westnordost/osmapi, which depends on https://github.com/mttkay/signpost, implementing OAuth 1.0a.

Looking at https://www.openstreetmap.org/user/{{your osm display_name}}/oauth_clients you should see StreetComplete underneath "My Authorised Applications". If you're the owner of client id and secret for SC, the SC application will also show up underneath My Client Applications. This page is for OAuth1.0a client applications.

[FloEdelmann]

Cross reference:

• Migrate to OAuth 2.0 #5322

[matkoniecz]

And westnordost/osmapi#33 which seems better issue for that