What’s happening?
Over the coming months, we will be making changes to the way that Access Tokens and Access Token Secrets are presented and managed within the applications Dashboard on developer.twitter.com
As a reminder - when you create (register) an app on developer.twitter.com, an individual and unique application identity is generated, represented by a private Consumer Key and Consumer Secret pair that is used as part of the OAuth flow.
It is also possible to generate an Access Token and Access Token Secret inside the Dashboard, which is associated with your app. These two additional private items are used to identify and authenticate your personal developer account to the application, without needing to go through the full Sign-in with Twitter flow. Remember that if you need to authenticate other users to your application, you will need to implement the Sign-in with Twitter process in order to receive Access Tokens and Access Token Secrets so that your application can act on behalf of those additional user accounts.
In order to make API integrations more secure, we will no longer show the Access Token and Access Token Secret on the Dashboard beyond the first time that these values are generated, effective January 21, 2020.
You will be able to regenerate the tokens on the Dashboard, but this will invalidate your current token and secret, and may require you to rewrite or redeploy existing code.
Action required!
If you have existing long-running apps that require this account-specific Access Token and Access Token Secret pair, please visit your Dashboard and save this information, now. You can find these values by visiting the application Details page inside the Dashboard, and clicking on the Keys and Tokens link. In the future, you should ensure that you save any newly-generated Access Token and Access Token Secret immediately after first-time generation, preferably in a secure system such as a password manager.
IMPORTANT: None of the four private pieces of identity and authentication information (Consumer Key, Consumer Token, Access Token, and Access Token Secret) should ever be committed to public source control, in order to protect your application and/or user account from compromise or misuse.
This upcoming change does not affect Consumer Key access - these will continue to be visible and accessible in the Dashboard on a per-app basis.
A banner will be displayed on the app pages of developer.twitter.com over the coming months, until this change goes into effect in January 2020.
What’s next?
For any questions, please use the Developer Portal section of the forums.