The request token step is a little special…
You don’t need the oauth_token and oauth_token_secret in that context to make the signature. You omit oauth_token as one of your signing parameters. And when generating the composite signing key, you leave the place where oauth_token_secret would be used blank.
So instead of:
"{consumer_secret}&{oauth_token_secret}" you use “{consumer_secret}&” to sign the request.