Unable to authorize Streaming Endpoints

[asgs]

Hello! I’ve been banging my head against the wall unable to make the OAuth work on the Streaming API endpoints. I’ve referring to the https://dev.twitter.com/oauth/overview/authorizing-requests and the https://dev.twitter.com/oauth/overview/creating-signatures and am pretty sure the request is properly formed. All I get is 401 Unauthorized error each and every time.

I’ve not used a client library yet since I want to make it work via cURL first. I’m willing to disclose whatever request details that are useful in diagnosing the error.

Here is the last connection hash value I received in the response. I really hope you can trace the call in your logs and find out what EXACTLY is wrong.

x-connection-hash: e4900c9b8639d0f0e322d70588f3825b

[andypiper]

We’re not able to help with debugging of specific individual connections via hash or otherwise.

One thing you could try is to use twurl to make a connection, and check the headers it is setting using the trace option (-t). For example, something along these lines:

$ twurl -t -H stream.twitter.com -A "Accept-encoding: none" -d "follow=82196,59142,125487,351102,5411584" -X POST "/1.1/statuses/filter.json"
opening connection to stream.twitter.com:443...
opened
starting SSL for stream.twitter.com:443...
SSL established
<- "POST /1.1/statuses/filter.json HTTP/1.1\r\nAccept-Encoding: none\r\nAccept: */*\r\nUser-Agent: OAuth gem v0.4.7\r\nContent-Type: application/x-www-form-urlencoded\r\nAuthorization: OAuth oauth_consumer_key=\"a0GPjhjhkhjDEMOkhkahjhkjhaks8fF9\", oauth_nonce=\"8OqElhhkjhkjhkDEMOjakasD8sZJ1u4\", oauth_signature=\"54IjhkDEMOhjkhSg%3D\", oauth_signature_method=\"HMAC-SHA1\", oauth_timestamp=\"1504697437\", oauth_token=\"klhhlhDEMOkjhjkhihkh\", oauth_version=\"1.0\"\r\nConnection: close\r\nHost: stream.twitter.com\r\nContent-Length: 62\r\n\r\n"
<- "follow=82196%2C59142%2C125487%2C351102%2C5411584"
-> "HTTP/1.1 200 OK\r\n"
-> "connection: close\r\n"
-> "content-type: application/json\r\n"
-> "date: Wed, 06 Sep 2017 11:30:38 GMT\r\n"
-> "server: tsa\r\n"
-> "transfer-encoding: chunked\r\n"
-> "x-connection-hash: a4f5105015f2a8820e1b243f07fa36c1\r\n"
-> "\r\n"

[asgs]

Yes, I always turn on the -v verbose option and I can indeed see the headers are in the format expected by the API. I also understand turning down invalid requests with a generic error is the best practice, but as a developer, who is just getting started with API, diagnostics do help.

What exactly is wrong with the request resulting in a 401 is what I’m interested in knowing.

[andypiper]

One issue that is worth checking is that your system time is accurate, as that is a common cause of OAuth issues since there’s a time component. Otherwise, I’d recheck that you are generating the nonce and signature using the correct methods.

There’s unfortunately no log data we can provide from our side on any specific individual connection attempt - I do understand that more detailed information would be helpful to you, but that’s not something that is available in this case.

[asgs]

yes, those are the usual suspects, but I ended up using the Java hbc library which works absolutely fine.