I now have part of the picture. There is an undocumented function called HTTPClient`OAuthAuthentication[] which takes only options as arguments. These options settings override defaults that are visible in HTTPClient`OAuth.m. Here is an example of how to make get an OAuth 1.0a style access token, in this case for the Withings API:
token = HTTPClient`OAuthAuthentication[
"ConsumerKey" -> "your_app_key",
"ConsumerSecret" -> "your_app_secret",
"RequestEndpoint" -> "https://oauth.withings.com/account/request_token",
"AuthorizeEndpoint" -> "https://oauth.withings.com/account/authorize",
"AccessEndpoint" -> "https://oauth.withings.com/account/access_token"]
This will kick off the workflow for a desktop app, which means there is no callback URL (includes helpful dialog). The Withings API chokes on this due to the lack of callback, but you can pull the necessary verifier from the URL of their attempted redirect. The result of successfully obtaining an access token will be an HTTPClient`OAuthToken, which contains all of the necessary information to make properly authenticated calls to the API. Here is an example of such a call:
url = "http://wbsapi.withings.net/measure?action=getmeas";
data = URLFetch[url, "OAuthAuthentication" -> token,
"Parameters" -> {"userid" -> "your_user_id"}];
This results in an http GET request with the oauth arguments supplied in the URL rather than as Authentication headers. As you can see, you can apply additional parameters and even change the method to POST by supplying arguments to URLFetch[]. This works for the Withings API, but some other APIs, like Fitbit, require headers. I solved that problem by extending the open source java project called scribe (https://github.com/fernandezpablo85/scribe-java) so that Mathematica handles the authentication and scribe classes are called via JLink in order to make properly formatted calls. If anyone can figure out how to modify URLFetch[] to get the headers into the proper form, it would be most helpful.
Here is an example of a token for OAuth 2.0:
token = HTTPClient`OAuthAuthentication[
"ConsumerKey" -> "your_app_key",
"ConsumerSecret" -> "your_app_secret",
"AuthorizeEndpoint" -> "https://www.facebook.com/dialog/oauth",
"AccessEndpoint" -> "https://graph.facebook.com/oauth/access_token",
"RedirectURI" -> None,
"OAuthVersion" -> "2.0"]
Notice there is no request endpoint and you must supply the version. I also should note that I can't get this to work at the moment since I don't have a proper canvas URL as part of my Facebook app registration.
It is important to note that all of these functions are undocumented, so they are rather difficult to use and no doubt subject to change!
@rm -rf: Thanks for reformatting and correcting my original question. I tried to apply your wisdom here.
Note: Mathematica v9.0.0 and Mathematica v9.0.1 seem to return different data structures after HTTPClient`OAuthAuthentication is used. What you see above is from Mathematica v9.0.1.
UPDATE:
I am able to successfully add the authentication parameters to an Authorization header by doing the following:
URLFetch[url,
"Headers" -> {"Authorization" ->
"OAuth " <>
StringJoin[
Riffle[{#[[1]] <> #[[2]] <> "\"" <> #[[3]] <>
"\""} & /@ (Riffle[#, "="] & /@
Sort[StringSplit[#, "="] & /@
StringSplit[
StringSplit[
HTTPClient`OAuthSignURL[
url, {"CredentialsProvider" -> None,
"OAuthAuthentication" -> token}][[1]], "?"][[2]],
"&"]]), ", "]]}]
