Callback URI

[scbritton]

I'm stumped on the callback leg of the OAuth process. I've been going around in circles for ages, and I really don't know what I'm supposed to be doing here.

I'll define a few terms first so we all know what I'm talking about.

SERVER: A wordpress site which contains the REST API with OAuth1 Plugin. (http://server.ext)
CLIENT: A wordpress site which wants to access the REST API interface via the consumer key/secret pair set up on the server. (http://client.ext)

It seems to be the case that the CALLBACK needs to be an absolute URI, with a path directly to a PHP file on he server. If the php file is on the client, then the callback url will change every time.

For example, I have set up the callback file as "callback.php", and, initially, I set it up as a custom page template residing inside the active theme folder. It contains one (and only one) line of code:

echo 'FOOBAR';

The intent being to prove that the callback is being accessed.

This ONLY works if I set up the callback uri as http://server.ext/wp-content/themes/{active_theme_name}/callback.php

As a page template, I can obviously create a page with the appropriate page slug, but this comes back as an invalid callback url.

When I send the callback url as part of my request header, it needs to match the callback url in the setup screen exactly.

The problem then is this - how in heaven's name do I get the verifier token and temporary token and secret back to the client that wants to authenticate with the server, if the callback.php file has to reside on the server side?

I'm totally stuck at this point, as right now, this just doesn't make sense to me. I'm obviously missing something.

Please help.