$callbackurl = APP_URL . "callback.php?" . $_SERVER['QUERY_STRING'];
//url de retorno
$lbsid = 'C40649834B4B1Z4B12';
$url_request = "http://api.apontador.com.br/v1/oauth/request_token";
// url pra pedir o oauth_token e oauth_secret (antes de autorizar)
$url_authorize = "http://api.apontador.com.br/v1/oauth/authorize";
// url pra pedir autorizacao
$options = array('consumer_key' => $key, 'consumer_secret' => $secret);
$method = "GET";
$params = null;
try {
    $consumer = new OAuthConsumer($key, $secret, NULL);
    $signature_method = new OAuthSignatureMethod_HMAC_SHA1();
    // Passo 1: Pedir o par de tokens inicial (oauth_token e oauth_token_secret) para o Apontador
    $req_req = OAuthRequest::from_consumer_and_token($consumer, NULL, "GET", $url_request, array());
    $req_req->sign_request($signature_method, $consumer, NULL);
    //a classe $req_req ao ser transformada em string nos devolve o url para pedir a chave
    $reader = new Url_Reader((string) $req_req);
    if ($reader->success()) {
        parse_str($reader->get());
    } else {
        throw new Exception(sprintf('Falha ao buscar auth token e token secret em %s. - %s'), (string) $req_req, $reader->get_errors());
    }
    //redireciona pro apontador pedindo autorizacao
    $oauth_callback = "{$callbackurl}&key={$key}&secret={$secret}&token={$oauth_token}&token_secret={$oauth_token_secret}&endpoint=" . urlencode($url_authorize);
    $auth_url = $url_authorize . "?oauth_token={$oauth_token}&oauth_callback=" . urlencode($oauth_callback) . "";
    //	var_dump($key,$secret,$auth_url);exit;
    header("Location: {$auth_url}");
} catch (OAuthException2 $e) {
    var_dump($e);
}
function _post($url, $method, $data = null, $optional_headers = null)
{
    $options = array(CURLOPT_CUSTOMREQUEST => $method);
    if ($optional_headers !== null) {
        $options[CURLOPT_HEADER] = $optional_headers;
    }
    if ($data !== null) {
        $options[CURLOPT_POSTFIELDS] = $data;
    }
    $reader = new Url_Reader($url, $options);
    $response = false;
    if ($reader->success()) {
        $response = $reader->get();
    } else {
        $response = $reader->get_errors();
    }
    return $response;
}
$consumer = new OAuthConsumer($key, $secret, NULL);
$signature_method = new OAuthSignatureMethod_HMAC_SHA1();
$token = $_REQUEST["oauth_token"];
$verifier = $_REQUEST["oauth_verifier"];
if (!$token || !$verifier) {
    die('Token e verifier em branco.');
}
// Passo 3: Passa o token e verificador para o Apontador, que vai validar o callback
//          e devolver o token de acesso definitivo
$endpoint = "http://api.apontador.com.br/v1/oauth/access_token?oauth_verifier={$verifier}";
$parsed = parse_url($endpoint);
$params = array();
parse_str($parsed['query'], $params);
$acc_req = OAuthRequest::from_consumer_and_token($consumer, NULL, "GET", $endpoint, $params);
$acc_req->sign_request($signature_method, $consumer, NULL);
//parse_str(file_get_contents($acc_req), $access_token);
//var_dump($acc_req);//exit;
$reader = new Url_Reader((string) $acc_req);
if ($reader->success()) {
    parse_str($reader->get(), $access_token);
    //echo $access_token['oauth_token'];
    setcookie('oauth_token', $access_token['oauth_token'], time() + 2592000, '/') or die('seu navegador não aceita cookies');
    setcookie('oauth_token_secret', $access_token['oauth_token_secret'], time() + 2592000, '/');
    setcookie('user_id', $access_token['user_id'], time() + 2592000, '/');
    $urlredir = 'index.php';
    $urlredir .= isset($_GET['lbsid']) ? '?lbsid=' . $_GET['lbsid'] : '';
    header('Location:' . $urlredir);
} else {
    throw new Exception(sprintf('Falha ao buscar auth token e token secret em %s. %s', (string) $acc_req, $reader->get_errors()));
}
//var_dump($access_token);
    $cidade = $cidade;
    $uf = urlencode($uf);
    $term = urlencode($term);
    $url .= "&city={$cidade}&state={$uf}&term={$term}";
} else {
    $placeid = $_GET['lbsid'];
    $url = sprintf('http://api.apontador.com.br/v1/places/%s?type=json', $placeid);
}
//echo $url;
$options = array(CURLOPT_HTTPAUTH => CURLAUTH_BASIC, CURLOPT_PORT => $port, CURLOPT_USERPWD => "{$key}:{$secret}");
$reader = new Url_Reader($url, $options);
if ($reader->success()) {
    //retornou legal do servidor
    //echo $reader->get();
    //echo mb_detect_encoding($reader->get());
    $aRetorno = json_decode($reader->get());
    $places = array();
    //var_dump($aRetorno);
    if (!isset($_GET['lbsid'])) {
        if (intval($aRetorno->search->result_count) > 0) {
            foreach ($aRetorno->search->places as $k => $place) {
                $place = $place->place;
                $places[$k]['lbsid'] = $place->id;
                $places[$k]['nome'] = $place->name;
                $places[$k]['link'] = $place->main_url;
                $places[$k]['endereco'] = $place->address->street . ' ' . $place->address->number;
            }
        }
    } else {
        //se a busca for por lbsid o formato de retorno é um pouco diferente
        $place = $aRetorno->place;