Threads API Access Tokens Explained

# pip install flask requests
import os, secrets, time, requests
from urllib.parse import urlencode
from flask import Flask, redirect, request, session, abort

app = Flask(__name__)
app.secret_key = os.environ["FLASK_SECRET"]

APP_ID = os.environ["THREADS_APP_ID"]
APP_SECRET = os.environ["THREADS_APP_SECRET"]
REDIRECT_URI = "https://yourapp.com/callback"   # must match app settings exactly
SCOPES = "threads_basic,threads_content_publish"

@app.route("/login")
def login():
    session["state"] = secrets.token_urlsafe(24)
    params = {"client_id": APP_ID, "redirect_uri": REDIRECT_URI,
              "scope": SCOPES, "response_type": "code",
              "state": session["state"]}
    return redirect("https://threads.net/oauth/authorize?" + urlencode(params))

@app.route("/callback")
def callback():
    if request.args.get("state") != session.pop("state", None):
        abort(400, "State mismatch")
    code = request.args["code"].removesuffix("#_")

    # 1) code -> short-lived token (1 hour)
    short = requests.post("https://graph.threads.net/oauth/access_token", data={
        "client_id": APP_ID, "client_secret": APP_SECRET,
        "grant_type": "authorization_code",
        "redirect_uri": REDIRECT_URI, "code": code}).json()

    # 2) short-lived -> long-lived token (60 days)
    long = requests.get("https://graph.threads.net/access_token", params={
        "grant_type": "th_exchange_token", "client_secret": APP_SECRET,
        "access_token": short["access_token"]}).json()

    save_token(user_id=short["user_id"], token=long["access_token"],
               expires_at=time.time() + long["expires_in"])
    return "Connected to Threads ✓"

def save_token(user_id, token, expires_at):
    ...  # store encrypted in your database

// npm install express express-session
import express from "express";
import session from "express-session";
import crypto from "node:crypto";

const { THREADS_APP_ID: APP_ID, THREADS_APP_SECRET: APP_SECRET } = process.env;
const REDIRECT_URI = "https://yourapp.com/callback"; // must match app settings
const SCOPES = "threads_basic,threads_content_publish";

const app = express();
app.use(session({ secret: process.env.SESSION_SECRET, resave: false, saveUninitialized: false }));

app.get("/login", (req, res) => {
  req.session.state = crypto.randomBytes(24).toString("base64url");
  const params = new URLSearchParams({
    client_id: APP_ID, redirect_uri: REDIRECT_URI, scope: SCOPES,
    response_type: "code", state: req.session.state,
  });
  res.redirect(`https://threads.net/oauth/authorize?${params}`);
});

app.get("/callback", async (req, res) => {
  if (!req.query.state || req.query.state !== req.session.state) {
    return res.status(400).send("State mismatch");
  }
  delete req.session.state;
  const code = String(req.query.code).replace(/#_$/, "");

  // 1) code -> short-lived token (1 hour)
  const short = await fetch("https://graph.threads.net/oauth/access_token", {
    method: "POST",
    body: new URLSearchParams({
      client_id: APP_ID, client_secret: APP_SECRET,
      grant_type: "authorization_code", redirect_uri: REDIRECT_URI, code,
    }),
  }).then((r) => r.json());

  // 2) short-lived -> long-lived token (60 days)
  const qs = new URLSearchParams({
    grant_type: "th_exchange_token", client_secret: APP_SECRET,
    access_token: short.access_token,
  });
  const long = await fetch(`https://graph.threads.net/access_token?${qs}`).then((r) => r.json());

  await saveToken(short.user_id, long.access_token, Date.now() + long.expires_in * 1000);
  res.send("Connected to Threads ✓");
});

async function saveToken(userId, token, expiresAt) {
  /* store encrypted in your database */
}

app.listen(3000);

# 1) Open in a browser (user approves, you get ?code=... on your redirect URI)
https://threads.net/oauth/authorize?client_id=YOUR_APP_ID&redirect_uri=https://yourapp.com/callback&scope=threads_basic,threads_content_publish&response_type=code&state=RANDOM_STRING

# 2) Exchange the code for a short-lived token (1 hour)
curl -X POST https://graph.threads.net/oauth/access_token \
  -d client_id=YOUR_APP_ID \
  -d client_secret=YOUR_APP_SECRET \
  -d grant_type=authorization_code \
  -d redirect_uri=https://yourapp.com/callback \
  -d code=CODE_FROM_REDIRECT
# → { "access_token": "SHORT_LIVED", "user_id": 1234567890 }