The twitter API allows posting tweets via oauth v2, but media uploads require oauth v1 credentials. Do I need to ask users to go through both auth flows to be able to post tweets with media via my app, or am I missing something?
I've finally worked this out. Users auth with v2, then you upload media with your own creds but set the user as an additional owner.