tweaked out version of simplegeo/oauth2 3-way auth adapted to Y! Sports API

login.py

#!/usr/bin/env python
# -*- encoding: utf-8 -*-
"""
simplegeo/python-oauth2 basic 3-legged example adapted to Y! Sports OAuth API

references:
https://github.com/simplegeo/python-oauth2#twitter-three-legged-oauth-example
https://github.com/simplegeo/python-oauth2/issues/10
http://stackoverflow.com/questions/4026759/problems-with-python-oauth2-and-yahoos-fantasy-sports-api
"""

import urlparse
import oauth2 as oauth
import settings as s

# Y! Sports OAuth endpoints
request_token_url = 'https://api.login.yahoo.com/oauth/v2/get_request_token?oauth_callback=oob'
authorize_url = 'https://api.login.yahoo.com/oauth/v2/request_auth'
access_token_url = 'https://api.login.yahoo.com/oauth/v2/get_token'


consumer = oauth.Consumer(s.CONSUMER_KEY, s.CONSUMER_SECRET)
client = oauth.Client(consumer)

# Step 1: Get a request token. This is a temporary token that is used for 
# having the user authorize an access token and to sign the request to obtain 
# said access token.

resp, content = client.request(request_token_url, "GET")
if resp['status'] != '200':
    raise Exception("Invalid response %s." % resp['status'])

request_token = dict(urlparse.parse_qsl(content))

print "Request Token:"
print "- oauth_token        = %s" % request_token['oauth_token']
print "- oauth_token_secret = %s" % request_token['oauth_token_secret']
print 

# Step 2: Redirect to the provider. Since this is a CLI script we do not 
# redirect. In a web application you would redirect the user to the URL
# below.

print "Go to the following link in your browser:"
print "%s?oauth_token=%s" % (authorize_url, request_token['oauth_token'])
print 

# After the user has granted access to you, the consumer, the provider will
# redirect you to whatever URL you have told them to redirect to. You can 
# usually define this in the oauth_callback argument as well.
accepted = 'n'
while accepted.lower() == 'n':
    accepted = raw_input('Have you authorized me? (y/n) ')
oauth_verifier = raw_input('What is the PIN? ')

# Step 3: Once the consumer has redirected the user back to the oauth_callback
# URL you can request the access token the user has approved. You use the 
# request token to sign this request. After this is done you throw away the
# request token and use the access token returned. You should store this 
# access token somewhere safe, like a database, for future use.
token = oauth.Token(request_token['oauth_token'],
                    request_token['oauth_token_secret'])
token.set_verifier(oauth_verifier)
client = oauth.Client(consumer, token)

resp, content = client.request(access_token_url, "POST")
access_token = dict(urlparse.parse_qsl(content))

print "Access Token:"
print "- oauth_token        = %s" % access_token['oauth_token']
print "- oauth_token_secret = %s" % access_token['oauth_token_secret']
print
print "You may now access protected resources using the access tokens above." 
print

settings.py

APP_ID = ''
APP_TITLE = ''

CONSUMER_KEY = ''
CONSUMER_SECRET = ''

GAME_ID = '490391'

# this after doing the login dance -- might change
ACCESS_TOKEN = ''
ACCESS_SECRET = ''