1. Flickr Authentication
Mohamed Shehab

2. Stage 1 (Application Registration)
Get an application key and secret.
Assign the application CallBack URL.
Provide application description.
Provide application logo.

3. Stage 2 (Login URL) Create the Login Link
&perms=[perms]&api_sig=[api_sig]
Permissions (perms): includes:
read - permission to read private information
write - permission to add, edit and delete photo metadata (includes 'read')
delete - permission to delete photos (includes 'write' and 'read')
Signature (api_sig): How is the API signature computed ?

4. Stage 2 (Login URL)
The api_sig is the MD5 hash of the following strings concatenated:
secretvalue
‘api_key’
The actual API key value.
‘perms’
Your selected permission (read, write, delete).
$api_sig = md5($secret.’api_key’.$api_key.’perms’.’read’);

5. Step 2 (Getting the frob value)
When the user follows your login url, they are directed to the a page on flickr.com which asks them if they want to authorize your application.
Flickr will display your application title, application logo, and the type of permissions you are requesting from the user.
When the user accepts the request, they are sent back to the Callback URL you defined in the registration stage.
The Callback URL will have a ‘frob’ parameter added to it:
If the callback URL was then the user will be redirected to:
How to extract the frob value ?

6. Step 3: Convert the frob to an auth token
The callback URL is also called the authentication handler (auth handler) page.
The auth handler page needs to acquire an authentication token.
The auth handler page needs to take the frob and make a regular authenticated call to the API method flickr.auth.getToken to acquire that token.

7. Step 3: Convert the frob to an auth token
To make the call to he flickr.auth.getToken we need to compose the following URL:
api_sig=[api_sig];
The api_sig is the MD5 hash of the following:
$secret
‘api_key’
$api_key
‘frob’
$frob
‘method’
‘flickr.auth.getToken’
$api_sig = $secret.’api_key’.$api_key.’frob’.$frob.’method’.’flickr.auth.getToken’;

8. Step 3: Convert the frob to an auth token
To make the call to he flickr.auth.getToken we need to compose the following URL:
api_sig=[api_sig];
The api_sig is the MD5 hash of the following:
$secret
‘api_key’
$api_key
‘frob’
$frob
‘method’
‘flickr.auth.getToken’
$api_sig = md5($secret.’api_key’.$api_key.’frob’.$frob.’method’.’flickr.auth.getToken’);

9. Step 3: Convert the frob to an auth token
Upon calling the flickr authentication method it returns the following XML authentication response:
<auth>
<token> </token>
<perms>write</perms>
<user username="Bees" fullname="Cal H" />
</auth>
token: is the authentication token which is required for all following authenticated calls.
perms: requested permissions.
user: username of user who granted the application the above permission on their profile.

10. Step 4: Making an authenticated call
All authenticated calls have to include a signature.
For example to retrieve the users in a certain group you have to be authenticated when calling the method “flickr.groups.members.getList”
The signature is computed by hashing the arguments called by the API in alphabetical order.
For example:
auth_token=[auth_token]&api_sig=[api_sig]
api_key
auth_token
method
per_page
$api_sig = md5($secret.’api_key’.$api_key.’auth_token’.$auth_token.’method’.$method.’per_page.$per_page);