Hi there,
This is mostly for the people in the OAuth closed beta, but that is rapidly coming to an end so other may want to read this as well. One of the major changes requested was the ability for one application to have both read and read+write users [1]. This was a fundamental shift in the security model but last night I deployed the end of it so it's now working.
When sending a user to the authorize URL (/oauth/authorize) you can now include a parameter named oauth_access_type with a value of "read" or "write", depending on which you need. If your application needs to change the access type for a user you can send them back again. You will probably want to make sure your app works correctly when people re-authorize this way, since you need to replace the tokens you have.
We discussed a 3-button layout but decided that OAuth is confusing enough without moving choices onto the user. We also worked on a way for users to change the access type of a token but in the end every UI was confusing. Re-approval allows your app to handle the state change rather than sendinf them to the connections tab with instructions.
Thanks; — Matt Sanford [1] - http://code.google.com/p/twitter-api/issues/detail?id=302
