This is my curl cmd for api.twitter.com. It will return Could not authenticate you.
curl -i -v -X POST \
-H "Authorization: OAuth oauth_nonce=...................................." \
-d "status=Hello Twitter" \
--trace . \
https://api.twitter.com/1.1/statuses/update.json
However, when I use the same oauth header for upload.twitter.com, it works fine.
curl -i -v -X POST \
-H "Authorization: OAuth oauth_nonce=.................................." \
-F "media=@/home/yiwang/Desktop/mac_1024.jpg" \
https://upload.twitter.com/1.1/media/upload.json
I am 100% sure the oauth1 headers in both cases are the same.
Also I only see this through curl cmd. Through python-requests both cases works fine.