What's wrong with this PHP Twitter API POST?

Why am I getting the "Could not authenticate you" message from Twitter's API?

• I'm creating a website and I want to allow users to sign in with Twitter. I followed a tutorial and everything seemed to work. But when I allowed authentication from Twitter I got the above error. Here's the exact message I get: stdClass Object ( [request] => /1/account/verify_credentials.json?oauth_consumer_key=*********&oauth_nonce=*********************&oauth_signature=****************************&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1302636413&oauth_token=&oauth_version=1.0 [error] => Could not authenticate you. ) Any idea why I could be getting this? If you would like me to post the exact code I'm using on every page related to this please inform me. Here's the code after the user accepts to authorize my site: <?php require("twitteroauth/twitteroauth.php");  session_start();    function redirect(){     header('Location: twitterauthorize.php');    }     if(!empty($_GET['oauth_verifier']) && !empty($_SESSION['oauth_token']) && !empty($_SESSION['oauth_token_secret'])){ $twitteroauth= new TwitterOauth('**************************', '************************************', $_SESSION['oauth_token'], $_SESSION['oauth_token_secret']); $access_token=$twitteroauth->getAccessToken($_GET['oauth_verifier']); $_SESSION['access_token']= $access_token; $user_info=$twitteroauth->get('account/verify_credentials'); print_r($user_info);     } else {  redirect();         } ?>

• Answer:

  There are many reasons OAuth authentication can fail, but I think in this specific case, you're not including the access token in your request -- the API response here indicates that Twitter cannot find a user context to perform your request. The user context would be told to Twitter through the oauth_token=xyz parameter, which appears to be an empty value here. Your oauth_token field should be populated with the oauth_token value you received when exchanging the request token for the access token. Your signature generation step in this context should be signed with a composite string made up of your consumer secret and the access token secret (oauth_token_secret). If it's possible, I recommend using HTTP header-based Authentication instead of attaching your OAuth values to the query string of the URL -- it dramatically separates concerns and makes debugging easier.