# ⚠️ X OAuth 2.0 Implementation - Authentication Issue

**Date:** June 12, 2026  
**Status:** ⚠️ User Context authentication not available  
**Impact:** Tweet posting currently blocked  

---

## Problem Analysis

X API /tweets endpoint memerlukan **User Context** authentication, tapi sekarang hanya punya:

1. ❌ **Bearer Token** - Application-Only (tidak bisa post tweets)
   - Error: "Authenticating with OAuth 2.0 Application-Only is forbidden"

2. ❌ **OAuth 2.0 Access Token** - Invalid/mismatched with client credentials
   - Error: "invalid_client" saat refresh

3. ❌ **OAuth 1.0a Tokens** - Ada tapi format lama, endpoint /2 butuh OAuth 2.0

### Root Issue
X app Bokeplah belum dikonfigurasi dengan benar untuk User Context OAuth 2.0.

---

## Solution - Configure X App Properly

### Step 1: Go to X Developer Portal
```
https://developer.twitter.com/en/portal/dashboard
```

### Step 2: Select Your App
- Pilih app untuk Bokeplah
- Go to "Settings" tab

### Step 3: Configure "User authentication settings"
Cari bagian "User authentication settings":

**Auth settings yang diperlukan:**
- ✅ "OAuth 2.0" - ENABLED
- ✅ "Confidential client" - YES (recommended)
- ✅ "Permissions" - "Read and Write" (minimal)
- ✅ "Callback URLs" - `https://play.bokeplah.me/oauth/callback` (atau valid URL)
- ✅ "Website URL" - `https://play.bokeplah.me`

### Step 4: Generate New Tokens
1. Pergi ke "Keys and tokens"
2. Section "OAuth 2.0 Client ID and Client Secret":
   - Regenerate jika diperlukan
   - Copy Client ID dan Secret baru

3. Section "User Context" - "Generate":
   - Click "Generate" untuk access token & refresh token BARU
   - Copy kedua tokens

### Step 5: Update .env
```env
# OAuth 2.0 Client Credentials (FROM Step 4.2)
X_OAUTH2_CLIENT_ID=<new_client_id>
X_OAUTH2_CLIENT_SECRET=<new_client_secret>

# OAuth 2.0 User Context Tokens (FROM Step 4.3)
X_ACCESS_TOKEN=<new_access_token>
X_REFRESH_TOKEN=<new_refresh_token>

# Remove these if causing issues:
X_API_KEY=
X_API_SECRET=
X_BEARER_TOKEN=
X_ACCESS_TOKEN_SECRET=
```

### Step 6: Test
```bash
php artisan config:clear
php artisan cache:clear
php artisan x:test-oauth2 --validate
php artisan x:test-oauth2 --tweet="Test after configuration fix"
```

---

## Expected Flow (After Fix)

```
1. Service init
   ↓
2. Load OAuth 2.0 credentials
   ↓
3. Try to post tweet
   ↓
4. Use access token (valid)
   ↓
5. Tweet successful ✅
   ↓
6. If token expires:
   - Auto-refresh with refresh token
   - Get new access token
   - Retry
   ↓
7. Cycle repeats
```

---

## Current Code Status

✅ Implementation siap:
- Credential validation
- Token refresh mechanism
- Error handling & retries
- Logging dan debugging

⏳ Menunggu valid credentials dari Twitter Developer Portal

---

## Checklist untuk Fix

- [ ] Buka Twitter Developer Portal
- [ ] Cek app settings
- [ ] Enable OAuth 2.0 dengan User Context
- [ ] Generate new client credentials
- [ ] Generate new access + refresh tokens
- [ ] Update .env dengan credentials baru
- [ ] Run `php artisan config:clear`
- [ ] Test: `php artisan x:test-oauth2 --validate`
- [ ] Test: `php artisan x:test-oauth2 --tweet="Test"`
- [ ] Verify tweet appears on X.com

---

## Troubleshooting During Setup

### Error: "invalid_client"
- Verify client_id dan client_secret match di X Portal
- Regenerate if unsure
- Double-check di .env tidak ada extra spaces

### Error: "invalid_grant"
- Access/refresh token mungkin expired
- Regenerate dari X Portal
- Update .env dengan tokens baru

### Error: "Unsupported Authentication"
- Bearer token tidak bisa post tweets
- Pastikan X_OAUTH2 credentials ada (bukan API Key/Secret)
- Verify OAuth 2.0 User Context enabled

### Error: "403 Forbidden"
- Pastikan app punya "Read and Write" permissions
- Check di X Portal app settings
- Regenerate tokens setelah ubah permissions

---

## Technical Implementation

### Credentials Format Expected

```php
// OAuth 2.0 (untuk /2/tweets endpoint)
X_OAUTH2_CLIENT_ID = string(30-50 chars)
X_OAUTH2_CLIENT_SECRET = string(40+ chars)  
X_ACCESS_TOKEN = string(50+ chars, alphanumeric)
X_REFRESH_TOKEN = string(80-100 chars, contains colons)

// TIDAK GUNAKAN untuk /2/tweets:
X_API_KEY = OAuth 1.0a (beda era)
X_BEARER_TOKEN = Application-Only (beda scope)
```

---

## After Credentials Are Fixed

Fitur-fitur yang akan bekerja:
- ✅ Post simple tweets
- ✅ Post tweets dengan media
- ✅ Auto-refresh expired tokens
- ✅ Handle authentication errors
- ✅ Comprehensive logging
- ✅ Queue-based publishing

---

## Prevention untuk masa depan

1. **Set reminder** untuk regenerate tokens setiap 6 bulan
2. **Monitor logs** untuk auth failures
3. **Keep backup** dari valid credentials
4. **Document** app configuration di team wiki
5. **Test regularly** dengan `php artisan x:test-oauth2`

---

## Resources

- [X Developer Portal](https://developer.twitter.com/en/portal/dashboard)
- [OAuth 2.0 Setup Guide](https://developer.twitter.com/en/docs/authentication/oauth-2-0/user-context-oauth2)
- [API v2 Authentication](https://developer.twitter.com/en/docs/twitter-api/authentication/oauth-2-0)
- [Token Management](https://developer.twitter.com/en/docs/twitter-api/security/token-management)

---

**Action Required:** Update credentials di X Developer Portal  
**Estimated Time:** 10 minutes  
**Difficulty:** Easy

Once you complete these steps, X publishing will work perfectly! 🚀

---

**Last Updated:** June 12, 2026  
**Code Status:** Ready (awaiting valid credentials)