"Failed to validate oauth signature and token" when acquiring a request_token

JP_Moral · 2011-09-07T16:51:14.000Z

I am using

https://api.twitter.com/oauth/request_token

for the URL. I am using header-based authentication. The Authorization header looks like this:

OAuth oauth_nonce=“53b833b3808114c166d5b95eccf986ba4bb95b5d”,oauth_callback=“oob”,oauth_signature_method=“HMAC-SHA1”,oauth_timestamp=“1315414189”,oauth_consumer_key=“fy5lC1V4ojgaolKPnEsbg”,oauth_version=“1.0”,oauth_signature=“2OMyNDRK49sHNy/uknDwWOfjm9A=”

Thanks.

JP_Moral · 2011-09-12T03:32:57.000Z

Figured it out. The signature in the Authorization header needs to be URL-encoded.

buckshop123 · 2012-05-02T16:33:00.000Z

Similar issue.

POST https://api.twitter.com/oauth/request_token

Header
Host: api.twitter.com
User-Agent: Fiddler
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Authorization: OAuth oauth_nonce=“1e91616e4070cd96c846682a03675db4”,
oauth_callback=“http%3A%2F%2Fdev.gobuck.com”,
oauth_signature_method=“HMAC-SHA1”,
oauth_timestamp=“1335975534”,
oauth_consumer_key=“4CbmEH9Fav2X9mzQMBH6GA”,
oauth_signature=“4LWnFW3eRBo5%2BKj%2BhqQ8fnq4XzU%3D”,
oauth_version=“1.0”

Repeatedly generates a 400 error.

Any thoughts?

buckshop123 · 2012-05-02T17:19:00.000Z

I have addressed the 400 error but now encountering a 401. I am pulling the request header directly from the oauth tool available from Twitter. Posting directly to https://api.twitter.com/oauth/request_token using fidder. No luck. Any thoughts?

Authorization: OAuth oauth_consumer_key=“4CbmEH9Fav2X9mzQMBH6GA”, oauth_nonce=“e069cee28350c2dc8ac1bad1b48986ee”, oauth_signature=“bTHqukiBQ0XnLCoyxobZ72P4YqY%3D”, oauth_signature_method=“HMAC-SHA1”, oauth_timestamp=“1335979035”, oauth_token=“562308004-sdWylisn26oYX0ypjxJ9fXfUf88p0f5fwY6gCJHw”, oauth_version="1.0"
Host: api.twitter.com

episod · 2012-05-02T17:37:35.000Z

I’m not aware of what Fidder does or does not do, but it’s possible it’s invalidating your request in other ways. A web console like that isn’t the best way to test the API nor the token negotiation methods.

Also, in your request for a request token there, you’re including an oauth_token – oauth_tokens aren’t a valid parameter for the request token step.

buckshop123 · 2012-05-02T17:59:31.000Z

The issue is encountered directly from the Fiddler client or in our own code.

The oauth_token was inserted in the header request using your oauth tool. If its not required why does your tool insert?

episod · 2012-05-02T19:36:19.000Z

The OAuth tool’s purpose is mainly to address resource API requests – it has less practicality for the OAuth authorization scenario. It’s not aware of which paths mean what, it simply takes the variables you provide to it and builds what a technically valid request would look like given those parameters.

The reason an oauth_token is accepted for oauth/request_token is because it’s a method without a pre-existing context – there’s no access token (no user making the request) and there’s no request token (you’re asking for that).

Jangalala925 · 2012-05-09T12:42:14.000Z

What is m.twitter.com’s appNamesapce?

SouthernNYorker · 2012-07-09T16:13:30.000Z

“A web console like that isn’t the best way to test the API nor the token negotiation methods.”…what is then?

gaushick · 2012-09-11T13:53:13.000Z

How to integrate twitter using flex mobile application.

xurimba · 2012-09-25T02:02:06.000Z

Dude fabulous ideas here

Milredel · 2012-10-16T16:43:00.000Z

Hi, I have a “NETWORK_ERR: XMLHttpRequest Exception 101” on this request :

http://api.twitter.com/oauth/request_token?oauth_consumer_key=vMTuvpBlvhEHBd4zhAw7wA&oauth_nonce=qjp8l&oauth_signature=4cQ1rwgLXBkZHT9VAxIX7ir%2BB%2Bk%3D&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1350405504

When I put it into the browser, I get a “Failed to validate oauth signature and token”.
But it was working before…
For what I can see, the query is well formatted, isn’t it ?
Any idea ?

episod · 2012-10-17T14:58:44.000Z

You’re missing an oauth_version parameer there it looks like. You’ll find better results using HTTP headers instead of query string parameters.

You should also never use XMLHttpRequest for any steps of the OAuth process. It’s a server-to-server operation.

1919273410 · 2013-01-11T08:14:00.000Z

I have the same problem with him in the.net environment but I haven’t found how to change because I.net also is not very understanding, there’s no such examples, can you give me a reference, it will thank you very much

episod · 2013-01-11T15:48:25.000Z

Check out these examples of using the .NET library LINQ to Twitter: http://linqtotwitter.codeplex.com/wikipage?title=Making%20API%20Calls&referringTitle=Home

QingpingWang · 2013-06-18T15:07:10.000Z

I am having the same problem, using this PHP SDK: https://github.com/abraham/twitteroauth
this is my url:
https://api.twitter.com/oauth/request_token?oauth_callback=http%3A%2F%2Flocalhost%2Fsparkmetricspro%2Fprojects%2FgetTwitterToken&oauth_consumer_key=gCSfhVwDhO4tzUhvGKgeVQ&oauth_nonce=7396c7c9e04225adbba95e3224481e96&oauth_signature=bq9%2Fm7e542SKrxn3urS72oK%2BChI%3D&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1371567893&oauth_version=1.0

BluePandaSDA · 2013-06-28T00:07:25.000Z

Hi did you resolve this issue? I’m getting same problem

brianjaputra · 2013-07-17T08:16:52.000Z

Same problem here. I have tried many things, from using abraham and codebird library, built similar library from zero, even used OAuth tool from Twitter application so I can test to execute cUrl generated from Twitter ITSELF. And the result is still same. I wonder what’s wrong with this API.

Santu_Clabs · 2014-01-18T04:49:45.000Z

Did u solve this?

shafiq · 2014-02-13T11:10:06.000Z

I was also getting same error and spent few hours to figure it out. One extra space was added in the beginning of CONSUMER_SECRET Code while copying it from dev.twitter.com.

That was some silly mistake that wasted my precious time. Hope it’ll help someone.