Cacher is the code snippet organizer for pro developers

Formula: Hash(SignatureBaseString, SigninKey)

Hash function:

• HMAC-SHA1 hashing algorithm
• e.g. in C#: Implementation

Generate SignatureBaseString:

1. Convert the HTTP Method to uppercase and set the output string equal to this value. e.g. POST
2. Append & e.g. POST&
3. Percent encode the URL and append it to the output string. URL should not include query string or hash parameters. e.g. POST&https%3A%2F%2Fapi.twitter.com%2F1%2Fstatuses%2Fupdate.json
4. Step 2 again e.g. POST&https%3A%2F%2Fapi.twitter.com%2F1%2Fstatuses%2Fupdate.json&
5. Percent encode the parameter string and append it to the output string.

Generate Parameter String:

Let's say:

status: Hello Ladies + Gentlemen, a signed OAuth request!
include_entities:   true
oauth_consumer_key: xvz1evFS4wEEPTGEFPHBog
oauth_nonce:    kYjzVBB8Y0ZFabxSWbWovY3uYSQ2pTgmZeNu2VS4cg
oauth_signature_method: HMAC-SHA1
oauth_timestamp:    1318622958
oauth_token:    370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb
oauth_version:  1.0

1. Percent encode every key and value that will be signed.
2. Sort the list of parameters alphabetically
3. For each key/value pair
4. Append the encoded key to the output string
5. Append the ‘=’ character to the output string
6. Append the encoded value to the output string
7. If there are more key/value pairs remaining, append a ‘&’ character to the output string

Example Parameter String:

include_entities=true&oauth_consumer_key=xvz1evFS4wEEPTGEFPHBog&oauth_nonce=kYjzVBB8Y0ZFabxSWbWovY3uYSQ2pTgmZeNu2VS4cg&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1318622958&oauth_token=370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb&oauth_version=1.0&status=Hello%20Ladies%20%2B%20Gentlemen%2C%20a%20signed%20OAuth%20request%21

Example Signature Base String:

POST&https%3A%2F%2Fapi.twitter.com%2F1%2Fstatuses%2Fupdate.json&include_entities%3Dtrue%26oauth_consumer_key%3Dxvz1evFS4wEEPTGEFPHBog%26oauth_nonce%3DkYjzVBB8Y0ZFabxSWbWovY3uYSQ2pTgmZeNu2VS4cg%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1318622958%26oauth_token%3D370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb%26oauth_version%3D1.0%26status%3DHello%2520Ladies%2520%252B%2520Gentlemen%252C%2520a%2520signed%2520OAuth%2520request%2521

Generate Sign In Key

Simply: Percent Encoded Consumer Secret + & + Percent Encoded Token Secret

Assume Consumer Secret is kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw Token Secret is LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE

Example Sign In Key: kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw&LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE

Finally, hashed signature is:

tnnArxj06cWHq44gCs1OSKk/jLY=

Requirements:

1.oauth_signature_key

Application Key. Get Here

2.oauth_nonce

• Base64 encoding 32 bytes of random data
• e.g. Guid.NewGuid().ToString("N") in C#

3.oauth_signature_method

Always HMAC-SHA1

4.oauth_signature

A value which is generated by running all of the other request parameters and two secret values through a signing algorithm.

5.oauth_timestamp

Indicates when the request was created. Twitter will reject requests which were created too far in the past, so it is important to keep the clock of the computer generating requests in sync with NTP.

6.oauth_token

Represents a user’s permission to share access to their account with your application.

7.oauth_version

Always 1.0

---

All the values should be percent encoded before attaching them to Authorization header

e.g. in C#: Uri.EscapeDataString("The value");

Example Authorization Header should be like this:

OAuth oauth_consumer_key="xvz1evFS4wEEPTGEFPHBog", oauth_nonce="kYjzVBB8Y0ZFabxSWbWovY3uYSQ2pTgmZeNu2VS4cg", oauth_signature="tnnArxj06cWHq44gCs1OSKk%2FjLY%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1318622958", oauth_token="370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb", oauth_version="1.0"