var _session:YahooSession;
   var _user:YahooUser;
  
   var _token:OAuthToken;
   
   // create a session by passing the consumer key and secret only.
   _session = new YahooSession("ABC123", "456XYZ");
   
   // grab the sessions auth object.
   var _auth:AuthenticationRequest = _session.auth;

   // get a request token and listen for the success event.
   _auth.addEventListener(YahooResultEvent.GET_REQUEST_TOKEN_SUCCESS, handleRequestTokenSuccess);
   _auth.getRequestToken();

   function handleRequestTokenSuccess(event:YahooResultEvent):void
   {
     // save the request token and then use it to send the user to the authorize page
     // then after the user has finished, we'll use it again in order to request an access token.
  
     _token = event.data as OAuthToken; 
     _auth.sendToAuthorization(_token);
   }
  
   // The userAuthFinish method should be called after the user has indicated 
   // that they have finished the authorization process. (ie: on button click)
  
   function userAuthFinish():void
   {
     // reuse the request token to request an access token.
  
     _auth.addEventListener(YahooResultEvent.GET_ACCESS_TOKEN_SUCCESS, handleAccessTokenSuccess);
     _auth.getAccessToken(_token);
   }
   
   function handleAccessTokenSuccess(event:YahooResultEvent):void
   {
     // save the access token and create a new session.
     _token = event.data as OAuthToken;
     
     // set the sessions token.
     _session.setAccessToken(_token);
  
     getUserProfile();
   }

   function getUserProfile():void
   {
      _user = _session.getSessionedUser();
      _user.profile.addEventListener(YahooResultEvent.GET_PROFILE_SUCCESS, handleGetProfileSuccess);
      _user.profile.getProfile();
   }

   function handleGetProfileSuccess(event:YahooResultEvent):void
   {
    var profile:Profile = event.data as Profile;
    // do something
   }

function readAndSetToken():void
{
   // read the token
   var token:OAuthToken = readToken();
   
   // try to the set the token, if its expired we'll use it to request a new one from Yahoo.
   if(_session.setAccessToken(token))
   {
      // ready to go.
   }
   else
   {
      _auth.addEventListener(YahooResultEvent.GET_ACCESS_TOKEN_SUCCESS, handleAccessTokenSuccess);
      _auth.getAccessToken(token);
   }
}

function handleAccessTokenSuccess(event:YahooResultEvent):void
{
   var token:OAuthToken = event.data as OAuthToken;
   trace("new token expires at:", new Date(token.tokenExpires).toString());
   
   if(_session.setAccessToken(token))
   {
      writeToken();
      // ready to go.
   }
}

// writes the current session token to the file system as an AMF object.
private function writeToken():void
{
	var fs:FileStream = new FileStream();
	fs.open(File.applicationStorageDirectory.resolvePath("AuthAccess.txt"), FileMode.WRITE);
	fs.writeObject( _session.getAccessToken() );
	fs.close();
}

// reads the token data if the file exists	
private function readToken():OAuthToken
{
	var f:File = File.applicationStorageDirectory.resolvePath("AuthAccess.txt");
	
	if(f.exists)
	{
		var fs:FileStream = new FileStream();
		fs.open(f, FileMode.READ);
		
		// read the file data object and parse it back into an OAuthToken
		var token:OAuthToken = AuthenticationRequest.toToken(fs.readObject());
		fs.close();
		
		return token;
	}
	else return null;
}