Call a protected resource with an OAuth 1.0a signed request

GEThttps://api.testingapis.com/api/auth/oauth1Sign in to see this endpoint's URL

Accepts the static token apibee-access-token / apibee-token-secret (never expires; user apibee), a token issued by POST /api/auth/oauth1/access_token, or no token at all for a two-legged (consumer-only) request. A request token is rejected: exchange it first. Query parameters are covered by the signature.Accepts the static token apibee-access-token / apibee-token-secret (never expires; user apibee), a token issued by POST …, or no token at all for a two-legged (consumer-only) request. A request token is rejected: exchange it first. Query parameters are covered by the signature.

Signing key: percentEncode(consumer_secret) + "&" + percentEncode(token_secret), with an empty token secret when there is no token. Signature methods: HMAC-SHA1, HMAC-SHA256, HMAC-SHA512 and PLAINTEXT; RSA-SHA1 is not supported. The rules for every signed request, and what each oauth_problem means, are under Signing rules on the OAuth 1.0a page.

Note: legs is "two-legged" and user is null when no token is sent. tokenExpiresIn is the seconds left for an issued token and null for the static token. signatureBaseString is the string the server signed (null for PLAINTEXT); on a signature mismatch the 401 carries it in details.signatureBaseString, so you can diff it against yours.

OAuth 1.0a signature: consumer apibee-consumer-key / apibee-consumer-secret, plus token apibee-access-token / apibee-token-secret, one from POST /api/auth/oauth1/access_token, or no token (two-legged)OAuth 1.0a signature: consumer apibee-consumer-key / apibee-consumer-secret, plus token apibee-access-token / apibee-token-secret, one from POST …, or no token (two-legged)

Parameters 7

Name	Type	Description
`oauth_consumer_key`required	header · string	apibee-consumer-key. In the Authorization: OAuth header, the query string or a form body (one place only).
`oauth_token`	header · string	apibee-access-token, an access token from POST /api/auth/oauth1/access_token, or left out for a two-legged request.apibee-access-token, an access token from POST …, or left out for a two-legged request.
`oauth_signature_method`required	header · string	HMAC-SHA1, HMAC-SHA256, HMAC-SHA512 or PLAINTEXT.
`oauth_signature`required	header · string	Base64 HMAC of the signature base string, or for PLAINTEXT the signing key itself: consumer_secret&token_secret, percent-encoded (& becomes %26).
`oauth_timestamp`	header · string	Unix time in seconds, within 5 minutes of server time. Required for the HMAC methods; may be left out for PLAINTEXT.
`oauth_nonce`	header · string	A random string; each one works once. Required for the HMAC methods; may be left out for PLAINTEXT.
`oauth_version`	header · string	Optional. If sent, it must be 1.0.

Responses

200: Signature valid. Returns the legs, signature method, where the OAuth parameters were found, the consumer key, token and user.
400: parameter_absent (a required OAuth parameter is missing), parameter_rejected (a parameter is duplicated or OAuth parameters are in more than one place), version_rejected or signature_method_rejected.
401: consumer_key_unknown, token_rejected, token_expired, timestamp_refused, nonce_used or signature_invalid. Carries WWW-Authenticate: OAuth realm="apibee", oauth_problem="...".

Example

Request

curl -X GET "https://api.testingapis.com/api/auth/oauth1" \
  -H 'Authorization: OAuth oauth_consumer_key="apibee-consumer-key", oauth_token="apibee-access-token", oauth_signature_method="PLAINTEXT", oauth_signature="apibee-consumer-secret%26apibee-token-secret"' \
  -H "X-TestingApis-Key: YOUR_API_KEY"

Response200 OK

{
  "authenticated": true,
  "scheme": "oauth1",
  "legs": "three-legged",
  "signatureMethod": "PLAINTEXT",
  "parametersIn": "Authorization header",
  "consumerKey": "apibee-consumer-key",
  "token": "apibee-access-token",
  "tokenExpiresIn": null,
  "user": {
    "username": "apibee",
    "name": "TestingAPIs Tester",
    "email": "tester@example.com"
  },
  "timestamp": null,
  "nonce": null,
  "signatureBaseString": null
}

The parameters, request and response examples and the live Try it panel for this endpoint are for signed-in members. Accounts are free and take a few seconds to create.

Try itSign-in requiredUses your key

api.testingapis.com

curl 'https://api.testingapis.com/api/auth/oauth1' \
  -H 'Authorization: OAuth oauth_consumer_key="apibee-consumer-key", oauth_token="apibee-access-token", oauth_signature_method="PLAINTEXT", oauth_signature="apibee-consumer-secret%26apibee-token-secret"' \
  -H 'X-TestingApis-Key: YOUR_API_KEY'

const res = await fetch("https://api.testingapis.com/api/auth/oauth1", {
  headers: {
    "Authorization": "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"apibee-access-token\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26apibee-token-secret\"",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
});
console.log(res.status, await res.text());

// The shape of the example response in the docs.
type ApiResponse = {
  authenticated: boolean;
  scheme: string;
  legs: string;
  signatureMethod: string;
  parametersIn: string;
  consumerKey: string;
  token: string;
  tokenExpiresIn: null;
  user: {
    username: string;
    name: string;
    email: string;
  };
  timestamp: null;
  nonce: null;
  signatureBaseString: null;
};

const res = await fetch("https://api.testingapis.com/api/auth/oauth1", {
  headers: {
    "Authorization": "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"apibee-access-token\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26apibee-token-secret\"",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
});
const body = (await res.json()) as ApiResponse;
console.log(res.status, body);

import requests

res = requests.get(
    "https://api.testingapis.com/api/auth/oauth1",
    headers={
        "Authorization": "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"apibee-access-token\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26apibee-token-secret\"",
        "X-TestingApis-Key": "YOUR_API_KEY",
    },
)
print(res.status_code, res.text)

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Get, "https://api.testingapis.com/api/auth/oauth1");
request.Headers.TryAddWithoutValidation("Authorization", "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"apibee-access-token\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26apibee-token-secret\"");
request.Headers.TryAddWithoutValidation("X-TestingApis-Key", "YOUR_API_KEY");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://api.testingapis.com/api/auth/oauth1"))
                .header("Authorization", "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"apibee-access-token\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26apibee-token-secret\"")
                .header("X-TestingApis-Key", "YOUR_API_KEY")
                .GET()
                .build();
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.testingapis.com/api/auth/oauth1", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"apibee-access-token\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26apibee-token-secret\"")
	req.Header.Set("X-TestingApis-Key", "YOUR_API_KEY")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.StatusCode, string(data))
}

GEThttps://api.testingapis.com/api/auth/oauth1

Query

Headers

oauth_consumer_keyrequiredstring

oauth_tokenstring

oauth_signature_methodrequiredstring

oauth_signaturerequiredstring

oauth_timestampstring

oauth_noncestring

oauth_versionstring

Call a protected resource with an OAuth 1.0a signed request

Parameters 7

Responses

Example

Related