title: Provider/Client 2-Legged OAuth I am understanding this correctly? (PHP implementation example)
body: <p>I provide a developer API to a set of data, I want to add 2-legged oauth authentication so I can authenticate developers apps to use the api. <strong>Firstly is this the best solution, for this type of authentication?</strong></p>
  
  <p><strong>Secondly,</strong> from an implementation/flow point of view, is my understanding correct:</p>
  
  <ol>
  <li><p>A random developer, goes to my site and uses a 'signup' page, which when submitted I generate them a api <strong>key</strong> and <strong>secret</strong>, that can be generated in anyway I wish.</p></li>
  <li><p>They then use an oauth library like the php one found <a href="http://oauth.googlecode.com/svn/code/php/OAuth.php" rel="nofollow">here</a> to sign their request with these credentials.</p>
  
  <p>$consumer = new OAuthConsumer('thegeneratedkey', 'thegeneratedsecret');</p></li>
  </ol>
  
  <p>$sig_method = new OAuthSignatureMethod_HMAC_SHA1;</p>
  
  <pre><code>//use oauth lib to sign request
  $req = OAuthRequest::from_consumer_and_token($consumer, null, "GET", 'http://mydonaim/api/', array('someapimethod', 'somevalue'));
  $sig_method = new OAuthSignatureMethod_HMAC_SHA1();
  $req-&gt;sign_request($sig_method, $consumer, null);//note: double entry of token
  </code></pre>
  
  <ol>
  <li>My server then uses the oauth library to check the 'signature' of that request to authenticate the developer app.</li>
  </ol>
  
  <p>$secret = 'secret'; // Ignore this line.</p>
  
  <pre><code>$secret = 'secret'; // Use the $_GET['oauth_consumer_key'] to find the secret in my system.
  $consumer = new OAuthConsumer($_GET['oauth_consumer_key'], $secret);
  $sig_method = new OAuthSignatureMethod_HMAC_SHA1;
  
  $method = $_SERVER['REQUEST_METHOD'];
  $uri = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
  $sig = $_GET['oauth_signature'];    
  $req = new OAuthRequest($method, $uri);
  
  //token is null because we're doing 2-leg
  $valid = $sig_method-&gt;check_signature( $req, $consumer, null, $sig );
  </code></pre>
  
  <p>Is this correct?</p>
  
  <p><strong>If so, does this authentication have to be done every time a request is made or can I generate a token of some kind to reduce the weight in each HTTP request from developer app to my api?</strong></p>