Attendees

ChrisMessina, LeahCulver, DaveRecordon, LarryHalff, AllenTom, BlaineCook

Notes

• questions about signing tokens
  • separate signing spec?
  • just use MD5, SHA1
• dick's oauth_token_type
• client app -- needs two types of tokens... (secret is not necessary secret -- JS, client app)
• web app only needs one type of token (secret is secret)
• flash apps like chumby, etc (can it access cookie headers?)