OAuth - Binding local user to 3rd party

I'm working on a mobile application, in which, the user can go for Facebook, Twitte开发者_运维技巧r or Foursquare authorization (via OAuth) rather than creating a new account and password.

The problem is, I'm not sure what should I store in my DB to point a 3rd party account. The auth_token, acquired from OAuth process seems to expire or change in some situations (like when the user changes password). So, it's not a good option.

What would be the long term option? I mean, even if user unauthorized my app, then authorizes it back, I would like to be able to find out the local user corresponding to them. Should I use the respective API's of each website and dig out user_id and store it? That would be consistent in between sessions I believe.

Any suggestions?

Thanks.

When you are getting the authorization from the sites, you need to only store the access_token (and refresh token if OAuth 2.0). With a OAuth 2.0 access_token, it will expire occasionally and you will need to use the refresh_token to get a new access_token. The user changing the password will not change the token, but the user would have the ability to revoke the token at any time.

Since they have to go through your mobile app to get the OAuth authentication, you should be able to link them together easily.