This document discusses the importance of the "/me" endpoint in APIs and social login. It notes that major tech companies like Facebook and Google are battling over users' online identities. The document then recommends that APIs expose basic user information like name, picture, and language via the "/me" endpoint using OAuth2 and proper scopes. Developers are advised to not expose sensitive data and should offer a way for users to revoke API permissions.

1. 30 May 2014
Bruno Pedro
The Importance of /me
picture©WernerKrause

2. Bruno Pedro
Web and Cloud Computing Technologist with
over ten years’ experience. CTO of GetApp.
Editor at APIUX.com.
http://brunopedro.com/

3. Web giants are waging a battle over
your online identity. — WSJ, May 21 2014

4. Facebook and Google will eventually be removed
from all Yahoo properties. – Reuters, March 5 2014

5. 53%
Social login preferences
January – March 2014
source: Gigya

6. Facebook business is about monetizing the
people in their network. — Businessweek, 2009

7. Use Facebook to actually prefill data that your
users might have to type. – Smashing Magazine

8. OAuth2 + proper scopes.

9. picture©WernerKrause
/me is a way to expose information
about the authorized user.

10. /me
‘me’ person ID
/account/verify_credentials
/user

11. What about your API?

12. What to expose
• username
• user picture or avatar
• first name and last name
• language
• time zone
• country

13. What not to expose
• e-mail address
• phone number
• billing information
• financial information
• mailing address
• current location
risk

14. Use the appropriate
OAuth2 scopes.

15. Use the appropriate
OAuth2 scopes.
“access my basic information”

16. Expose safe information!

17. Offer a way to
revoke permissions!

18. Questions?