The documentation on this feature has moved to http://code.google.com/apis/gadgets/docs/oauth.html
OLDER DOCUMENTATION
What is the OAuth Proxy?
What websites provide containers support gadgets and the OAuth Proxy?
Currently the iGoogle sandbox is a gadget container that supports this feature. However there is an open-source project called Shindig which is an implementation of the gadget specification as well as the OAuth Proxy feature. Many other Internet websites are evaluating deploying this technology.
What Internet services have REST APIs that support OAuth?
It is supported by all of the REST APIs available from Google (see OAuth and Data API docs) as well as MySpace's Data Availability APIs. The OAuth community wiki lists additional service providers that provide OAuth enabled APIs.
What gadgets use the OAuth Proxy that I can try out?
Try the following walkthroughs of a MySpace gadget and a Google gadget.
How do I get started?
If you are building a gadget to access the REST APIs exposed by the Google Data "GData" APIs, then refer to the GData Gadget guide. Otherwise refer to the instructions below.
Make a copy of the following sample gadget.
http://dirk.balfanz.googlepages.com/contacts-new.xml
<OAuth>
<Service name="myspace">
<Access url="http://api.myspace.com/access_token"/>
<Request url="http://api.myspace.com/request_token"/>
<Authorization url="http://api.myspace.com/authorize?oauth_callback=http://igdev.myspace.com/gadget/Auth.htm"/>
</Service>
</OAuth>
Step 3
If you are accessing a non-Google endpoint, then they generally will require you to register your application with them (for example see the MySpace registration), and they will provide you with a shared secret that is used to digitally sign all the requests from your application to the service provider. One problem with gadgets is that they are publicly accessible, so they are not a good place to store these types of secrets. Instead, you can register the shared secret with the website who provides the container in which your gadget will run, assuming they offer an OAuth Proxy. In the case of the iGoogle sandbox, you can send mail to oauthproxyreg@google.com with the following information to register your shared secret:
URL of your gadget
The shared secret assigned to you by the service provider
The consumer key assigned to you by the service provider
Whether to use symmetric or asymmetric signing with the service provider (or say that you don't know)
Note to OAuth service providers: If you want to help your development community avoid this manual registration step, you can instead look for a digital signature in the OAuth requests from the iGoogle proxy using the drat OAuth Gadgets Extension. That signature verifies it came from Google, and provides the URL of the gadget on whose behalf the request is being made. The iGoogle sandbox uses the following public key (here presented as a self-signed certificate that should be be easily importable into OAuth libraries implemented in various programming languages):
In the FetchData function of the sample gadget, change the URL parameter so that it calls the desired REST function endpoint. This is frequently the same as the request_url defined in step 2, but you might add additional parameters such as requesting the results in JSON format.
Modify the ShowResults function of the sample gadget to parse the data returned by the REST function and display the results in some basic way so you can confirm the gadget is properly communicating with the REST endpoint. The sample gadget expects to get an ATOM XML result in JSON format, and it iterates through looking for the “entry.gd$email[0].address” value. However if that is not the form you expect, then you will need to change this function.
Your gadget should now work and get data from the OAuth endpoint. However the user who adds the gadget will need to go through the web page workflow required to approve your gadget's access to their data. You can then start customizing the gadget as needed to create the desired user experience.
How can the user experience be optimized?
For iGoogle: TBD
For orkut: http://sandbox.orkut.com/Application.aspx?uid=16106640322329497443&appId=112386189666&bpc=1