There is some description of OOB flow in the Glossary section at the bottom of http://dev.twitter.com/pages/auth
out of band mode - Instead of providing a URL-based callback when acquiring a request token, "oob" is supplied. Once the user has given Twitter their account credentials, they are presented with a screen containing a PIN code and are asked to enter this code into the application. The application then sends this PIN as an oauth_verifier to the access token step to complete the exchange.
What that means in practice, compared to the normal web flow:
- In step (A) your app starts the flow by opening a browser window to the OAuth flow, but sends a request param of
oauth_callback=oob
rather than a callback URL
- Step (C) ends with Twitter displaying an authorization result page containing a PIN for the user (rather than making a callback to your app with the normal web flow)
- Step (D) requires the user to copy / type the PIN from the Twitter authentication page into your app (your app obviously needs some kind of "Waiting for authorization code..." screen for this :)
- Step (E) your app sends the PIN entered by the user back to Twitter in the
oauth_verifier
param to get an access token.
Try the OAuthConsumerWpf sample in DotNetOpenAuth http://www.dotnetopenauth.net/ for an example of OAuth Consumer code that you should be able to modify.