Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm developing a web app that will be able to access user's file on Ubuntu One.

Sites like GitHub, Twitter, Facebook, when an app request access to the user profile usually open a popup asking if you want to give the app the access while in this page about Ubuntu One API is written that I need to make a GET request with some parameters like email and password: so the user give the application not only the access but also the app can store user password which is not very secure... am I right or is there the possibility of a popup?

share|improve this question

That API is intended for creating desktop applications using the native widget set, rather than in-browser applications or integrating with a different site. For the latter you can do standard oauth; the user authorization url is (you can add a description via the query), the request URL is .../request/, and access token is .../access/.

share|improve this answer
really the api is specified fo r Cloud application not for ubuntu or desktop based – Matteo Pagliazzi Nov 2 '11 at 14:44
and what about callback url? – Matteo Pagliazzi Nov 2 '11 at 14:45
@Matteo, The api is for desktop use. What part made you think otherwise? – Chipaca Nov 2 '11 at 16:06
@Matteo, What about the callback url? – Chipaca Nov 2 '11 at 16:07
here on the left side there is Cloud under platforms – Matteo Pagliazzi Nov 2 '11 at 16:53

Currently Ubuntu One does not provide a way for three legged OAuth to grant third party applications to gain access to it's APIs. Your question has inspired me to file a bug (really a wish list) since it seems we are so close.

Note (and do not do this) that it is possible for your web site to collect the user's credentials to the SSO locally and then do some http requests to authenticate the user and handle the oauth dance. However, this is highly suspect and users would be just plain foolish to enter their username/password on an external site. Did I say, please don't do this? :)

share|improve this answer
I agree with you so I asked because since there are apis for Cloud/web apps it should be normal to have the possibility to link link an app using some official methods and not requesting directly password and username – Matteo Pagliazzi Nov 29 '11 at 15:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.