… Have you set up a callback URL with twitter (it doesn’t need to be a real URL, just needs to have a value)?
… Have you made your Twitter app an “@Anywhere” app (whatever that means)?
I’m moving testing onto a live site, just in case it’s “localhost” that’s the problem – twitter seems to be a stickler about which domains it will authorize requests from. Maybe that’s why the example recommends trying FB first.
I’ll let you know.
**edit** no, no need to create a new key+secret. I’m getting the same response with my own set.