Getting started with eBay API Tokens (Oauth) with PHP

Official Guide:

I’ll also cover some mistakes I made.

  1.  Signup at
  2. Create an App and get the App ID (Client ID) and Cert ID (Client Secret)
  3. Click ‘User Tokens‘ (either from sandbox or production, depend on you)
  4. Click “Get a Token from eBay via Your Application” then “Add eBay Redirect URL
  5. Fill in the form, the only important thing is the “Your auth accepted URL“, it should be under your domain. (You should able to extract the auth code from the call back later, for example $_GET[‘code’] in PHP),  let’s assume this
  6. Take down the value of “RuName (eBay Redirect URL name)” and “Your branded eBay Production Sign In (OAuth)

So far, we’ve done our preparation at

Then, on you local developing environment or you production server,:

  1. Set user login you own website
  2. put a hyperlink pointing to the URL of “Your branded eBay Production Sign In (OAuth)
  3. visitor click on that link, and login with their ebay account.
  4. ebay will make a callback redirect to “Your auth accepted URL” if success.

On the “Your auth accepted URL“, prepare a PHP script that get the value of $_GET[‘code’] and save it in sessions. It starts with ‘v%5E1’. this is called “Authorization Code

Next, get an “Access Token” with this “Authorization Code” 

Craft a HTTP Request with whatever you like with PHP.

HTTP headers:
Content-Type = application/x-www-form-urlencoded
Authorization = Basic <B64-encoded-oauth-credentials>

HTTP method: POST


Request body (wrapped for readability):

We have three ‘Variables’ here.

<B64-encoded-oauth-credentials>: Use a Chrome Browser, Right click, Inspect, Console
Then type: btoa(‘APP_ID:CERT_ID‘);
We did take down these two values earlier. and there is a : between.
Hit ENTER, the value inside the double quotes is <B64-encoded-oauth-credentials>

<authorization-code>: the ‘Authorization Code‘ we got in the callback redirect.

<redirect_URI>: This is the tricky part. This can’t be ignored or filled with random things, it’s the value of “RuName (eBay Redirect URL name)

Send the request, and you’ll get the access token and the refresh token.
Follow the official guide to refresh the token if expired.

We are basically finished here, If you wanna call an API, ‘List orders as a seller’ for instance:


Authorization: Bearer <YOUR_ACCESS_TOKEN>
It’s Bearer this time :), don’t use Basic by mistake.

Remove the Loop Icon for VOX

VOX is the best music players on OSX I’ve ever used.

The Loop becomes one of it’s features to store unlimited music on it’s platform. It’s a good feature, and the only way for the developer to get some pay back for the wonderful applet.

I just don’t need it, and try to save some space for my menu bar.

On the VOX’s preference page, uncheck “Keep Loop Agent Running when” just doesn’t make any sense. Neither for “launchctl remove com.coppertino.VOXCloud” as the developer mentioned.

My way to close that:

Finder – Application – VOX – right click – Show package contents – Contents – Library – LoginItems

You can find the here, but things like deleting/renaming/[removing permission] will all prevent VOX from launching. – Show package contents – Contents – Resources – Base.lproj

Then rename “MainMenu.nib” to something else for example: “MainMenu.nib.bye”

Quit Loop and restart VOX, Done.

Note on sshd_config Setup

What’s sshd_config?

It’s “OpenSSH SSH daemon configuration file”

Simply means the config file for OpenSSH Server.

Located at /etc/ssh/sshd_config

My reference

ListenAddress and Port

By default, OpenSSH will listen on port 22 for all address( and ::)

There can be multiple Port defined, for example:

OpenSSH will listen on both ports

ListenAddress specify the address to listen, the address can be hostname, ipv4 or ipv6

You may also add an optional port number, for example:

OpenSSH will listen on and at port 22, plus port 922

If there are multiple “Port” specified:

Then are listened


If port is not specified, sshd will listen on the address and all prior Port options specified.

Access Control:

Process order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

If none of the four is defined, login is allowed fro all users.

If Allow* is defined, login is only allowed to declared users and groups.

Only username and groupname are accepted, UID and GID are NOT.

In the following example, only ‘root’ and ‘user’ are allowed

In the following example, only ‘user2’ is denied.

Limit user to specified destination address and port

Supposed the OpenSSH server is listening to multiple IPs ( and

At the end of sshd_config file: add:

You may also specify port

You may also specify address and port


Match Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file. If a keyword appears in multiple Match blocks that are satisfied, only the first instance of the keyword is applied.


Limit user from specified source address

More details on HOST:

Host: Restricts the following declarations (up to the next Host or Match keyword) to be only for those hosts that match one of the patterns given after the keyword. If more than one pattern is provided, they should be separated by whitespace. A single `*’ as a pattern can be used to provide global defaults for all hosts. The host is the hostname argument given on the command line (i.e. the name is not converted to a canonicalized host name before matching). A pattern entry may be negated by prefixing it with an exclama- tion mark (`!’). If a negated entry is matched, then the Host entry is ignored, regardless of whether any other patterns on the line match. Negated matches are therefore useful to provide exceptions for wildcard matches.

Here is another approach using Match:

At the end of sshd_config file: add:

Bugs and Tips found recently

1: Teensy as a keyboard does not work properly in GRUB.

Solution: break your long input into parts (<=3 chars) and add delays (50ms is enough) between them.


2: In Debian and Ubuntu, your may install some PHP PECL modules just by using

(PHP run as an apache mod)

Restart Apache, php -m does not show any new module installed.

Try add ini files(propro.ini File Content: to /etc/php5/mod-available and make link (15-propro.ini for example) at /etc/php5/apache/conf.d pointing to /etc/php5/mod-available/propro.ini

restart Apache again, php module still not loading.

The solution:

use php5enmod propro instead :)
3: Dell PowerEdge RAID Controller (PERC) H730 and SSD.
Unable to build raid for Samsung 850 EVO SSD in the Lifecycle Manager.

Solution: goto BIOS and find device management- raid controller then build your RAID there.

How to get a certification to sign PDFs

I’m trying to get a certification to sign my PDF files these days.

My Goal:

  1. It is a certification signed by a trusted CA in Adobe Acrobat (of course it can’t be self-signed)
  2. It is cheap

What I did:

Check the current list of Adobe Approved  Trusted CA (

Check those CA’s website.

Many of those CA are used inside their company/organization only, Some “Widely known CA” like DigiCert, GlobalSign, Entrust cost a lot(200-800 USD/year) for the certification, and you maybe asked for purchasing a USB device for the cert, PLUS, some of them limit the number of files you signed.

Finally I found “CERTUM (Unizeto Technologies)” in Porland, they supply a certification for a low cost(~10USD/year)

Read More

[Apache] Rewrite subdomain as subfolder

What You Want:

—————–/123/index.php ===>
—————–/www/index.php ===>
—————–/blog/index.php ===>
—————–/email/main/index.php ===>

Set dns:

A (may be AAAA) * to your server’s IP address.

This is the rewrite code you should use:


Options -Indexes

Will not working in this case. Since Apache can not find the subfolder if you hide them. All subdomains will return a 404 error.

isset() vs empty() vs is_null()

PHP has different functions which can be used to test the value of a variable. Three useful functions for this are isset()empty() and is_null(). All these function return a boolean value. If these functions are not used in correct way they can cause unexpected results.

isset() and empty() are often viewed as functions that are opposite, however this is not always true. In this post I will explain the differences between these functions.



From PHP manual – isset():

isset — Determine if a variable is set and is not NULL

In other words, it returns true only when the variable is not null.

From PHP Manual – empty():

empty — Determine whether a variable is empty

In other words, it will return true if the variable is an empty string, false, array(), NULL, “0?, 0, and an unset variable.

From PHP Manual – is_null():

is_null — Finds whether a variable is NULL

In other words, it returns true only when the variable is null. is_null() is opposite of isset(), except for one difference that isset() can be applied to unknown variables, but is_null() only to declared variables.

The table below is an easy reference for what these functions will return for different values. The blank spaces means the function returns bool(false).
Value of variable ($var) isset($var) empty($var) is_null($var)
“” (an empty string) bool(true) bool(true)
” ” (space) bool(true)
FALSE bool(true) bool(true)
TRUE bool(true)
array() (an empty array) bool(true) bool(true)
NULL bool(true) bool(true)
“0″ (0 as a string) bool(true) bool(true)
0 (0 as an integer) bool(true) bool(true)
0.0 (0 as a float) bool(true) bool(true)
var $var; (a variable declared, but without a value) bool(true) bool(true)
NULL byte (“\ 0″) bool(true)
Copy From  By Virendra on January 21, 2012