0

I am trying to call an API with OAuth1.0. But the signature I am generating with my custom code is not matching with the signature that is present in postman. The reason I want both to match is because with Postman I am successfully able to call the API without any issue.

Dummy details that i tried:

URL: https://localhost:4857/fun Signature Method:HMAC-SHA1 Consumer Key: a Consumer Secret: b Access Token: 123 Token Secret: abc TimeStamp: 123 Nonce: 3

With these details I am getting the Signature URL String as GET&https%3A%2F%2Flocalhost%3A4857%2Ffun&oauth_consumer_key%3Da%26oauth_nonce%3D3%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D123%26oauth_token%3D123

Key: b&abc

I am encoding both key and signature url string in UTF-8 encoding

Generated Signature from the python hmac module is e5q17ELBiktwG%2F%2F7TAouAkNKcFI%3D

But Postman is generating the signature as Fs55QGeBXI%2BG3ckdHQLmjwI%2BeUQ%3D

Entire Postman output

GET /fun HTTP/1.1
Host: localhost:4857
Authorization: OAuth oauth_consumer_key="a",oauth_token="123",oauth_signature_method="HMAC-SHA1",oauth_timestamp="123",oauth_nonce="3",oauth_version="1.0",oauth_signature="Fs55QGeBXI%2BG3ckdHQLmjwI%2BeUQ%3D"

I had used the below code to generate the above signature

import hmac
from hashlib import sha1
import base64
import urllib.parse

consumerKey = 'a'
consumerSecret = 'b'
token = 123
tokenSecret = 'abc'
timestamp = 123
nonce = 3


key = '{}&{}'.format(consumerSecret,tokenSecret)
keyencoded = bytes(key,'utf-8')

url = 'https://localhost:4857/fun'
auth = 'oauth_consumer_key={}&oauth_nonce={}&oauth_signature_method=HMAC-SHA1&oauth_timestamp={}&oauth_token={}'.format(consumerKey,nonce,timestamp,token)

urlencoded = urllib.parse.quote(url , safe='')
authencoded = urllib.parse.quote(auth , safe='')


baseString = 'GET&'+urlencoded+'&'+authencoded
baseStringEncoded = bytes(baseString,'utf-8')


signature = hmac.new(keyencoded,baseStringEncoded,sha1)

signaturebase64 = base64.b64encode(signature.digest()).decode()

signUrlEncode = urllib.parse.quote(signaturebase64, safe='')

print(baseString)
print(signUrlEncode)

Please let me know what am I doing wrong? I would really appreciate any help in understanding why postman is generating a different signature than my one.

James Z
  • 12,209
  • 10
  • 24
  • 44
Gaurab
  • 1

0 Answers0