Send a form to a protected resource with an OAuth 1.0a signed request

POSThttps://api.testingapis.com/api/auth/oauth1Sign in to see this endpoint's URL

Same credentials and rules as GET /api/auth/oauth1. Fields of an application/x-www-form-urlencoded body are part of the signature; other body types are not signed. The OAuth parameters may go in the form body instead of the Authorization header, but not in both.Same credentials and rules as GET …. Fields of an application/x-www-form-urlencoded body are part of the signature; other body types are not signed. The OAuth parameters may go in the form body instead of the Authorization header, but not in both.

OAuth 1.0a signature: consumer apibee-consumer-key / apibee-consumer-secret, plus token apibee-access-token / apibee-token-secret, one from POST /api/auth/oauth1/access_token, or no token (two-legged)OAuth 1.0a signature: consumer apibee-consumer-key / apibee-consumer-secret, plus token apibee-access-token / apibee-token-secret, one from POST …, or no token (two-legged)

Parameters 7

Name	Type	Description
`oauth_consumer_key`required	header · string	apibee-consumer-key. In the Authorization: OAuth header, the query string or a form body (one place only).
`oauth_token`	header · string	apibee-access-token, an access token from POST /api/auth/oauth1/access_token, or left out for a two-legged request.apibee-access-token, an access token from POST …, or left out for a two-legged request.
`oauth_signature_method`required	header · string	HMAC-SHA1, HMAC-SHA256, HMAC-SHA512 or PLAINTEXT.
`oauth_signature`required	header · string	Base64 HMAC of the signature base string, or for PLAINTEXT the signing key itself: consumer_secret&token_secret, percent-encoded (& becomes %26).
`oauth_timestamp`	header · string	Unix time in seconds, within 5 minutes of server time. Required for the HMAC methods; may be left out for PLAINTEXT.
`oauth_nonce`	header · string	A random string; each one works once. Required for the HMAC methods; may be left out for PLAINTEXT.
`oauth_version`	header · string	Optional. If sent, it must be 1.0.

Request body

Optional. application/x-www-form-urlencoded. Any form fields; they are covered by the OAuth signature.

Example body

status=hello

Responses

200: Signature valid. Same body as GET /api/auth/oauth1.Signature valid. Same body as GET ….
400: parameter_absent (a required OAuth parameter is missing), parameter_rejected (a parameter is duplicated or OAuth parameters are in more than one place), version_rejected or signature_method_rejected.
401: consumer_key_unknown, token_rejected, token_expired, timestamp_refused, nonce_used or signature_invalid. Carries WWW-Authenticate: OAuth realm="apibee", oauth_problem="...".

Example

Request

curl -X POST "https://api.testingapis.com/api/auth/oauth1" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H 'Authorization: OAuth oauth_consumer_key="apibee-consumer-key", oauth_token="apibee-access-token", oauth_signature_method="PLAINTEXT", oauth_signature="apibee-consumer-secret%26apibee-token-secret"' \
  -d 'status=hello' \
  -H "X-TestingApis-Key: YOUR_API_KEY"

Response200 OK

{
  "authenticated": true,
  "scheme": "oauth1",
  "legs": "three-legged",
  "signatureMethod": "PLAINTEXT",
  "parametersIn": "Authorization header",
  "consumerKey": "apibee-consumer-key",
  "token": "apibee-access-token",
  "tokenExpiresIn": null,
  "user": {
    "username": "apibee",
    "name": "TestingAPIs Tester",
    "email": "tester@example.com"
  },
  "timestamp": null,
  "nonce": null,
  "signatureBaseString": null
}

The parameters, request and response examples and the live Try it panel for this endpoint are for signed-in members. Accounts are free and take a few seconds to create.

Try itSign-in requiredUses your key

api.testingapis.com

curl -X POST 'https://api.testingapis.com/api/auth/oauth1' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Authorization: OAuth oauth_consumer_key="apibee-consumer-key", oauth_token="apibee-access-token", oauth_signature_method="PLAINTEXT", oauth_signature="apibee-consumer-secret%26apibee-token-secret"' \
  -H 'X-TestingApis-Key: YOUR_API_KEY' \
  --data-urlencode 'status=hello'

const res = await fetch("https://api.testingapis.com/api/auth/oauth1", {
  method: "POST",
  headers: {
    "Content-Type": "application/x-www-form-urlencoded",
    "Authorization": "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"apibee-access-token\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26apibee-token-secret\"",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
  body: new URLSearchParams({
    "status": "hello",
  }),
});
console.log(res.status, await res.text());

// The shape of the example response in the docs.
type ApiResponse = {
  authenticated: boolean;
  scheme: string;
  legs: string;
  signatureMethod: string;
  parametersIn: string;
  consumerKey: string;
  token: string;
  tokenExpiresIn: null;
  user: {
    username: string;
    name: string;
    email: string;
  };
  timestamp: null;
  nonce: null;
  signatureBaseString: null;
};

const res = await fetch("https://api.testingapis.com/api/auth/oauth1", {
  method: "POST",
  headers: {
    "Content-Type": "application/x-www-form-urlencoded",
    "Authorization": "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"apibee-access-token\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26apibee-token-secret\"",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
  body: new URLSearchParams({
    "status": "hello",
  }),
});
const body = (await res.json()) as ApiResponse;
console.log(res.status, body);

import requests

res = requests.post(
    "https://api.testingapis.com/api/auth/oauth1",
    headers={
        "Content-Type": "application/x-www-form-urlencoded",
        "Authorization": "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"apibee-access-token\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26apibee-token-secret\"",
        "X-TestingApis-Key": "YOUR_API_KEY",
    },
    data={"status": "hello"},
)
print(res.status_code, res.text)

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.testingapis.com/api/auth/oauth1");
request.Headers.TryAddWithoutValidation("Authorization", "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"apibee-access-token\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26apibee-token-secret\"");
request.Headers.TryAddWithoutValidation("X-TestingApis-Key", "YOUR_API_KEY");
request.Content = new FormUrlEncodedContent(
[
    new("status", "hello"),
]);
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://api.testingapis.com/api/auth/oauth1"))
                .header("Authorization", "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"apibee-access-token\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26apibee-token-secret\"")
                .header("X-TestingApis-Key", "YOUR_API_KEY")
                .header("Content-Type", "application/x-www-form-urlencoded")
                .method("POST", HttpRequest.BodyPublishers.ofString("status=hello"))
                .build();
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader("status=hello")
	req, err := http.NewRequest("POST", "https://api.testingapis.com/api/auth/oauth1", body)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"apibee-access-token\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26apibee-token-secret\"")
	req.Header.Set("X-TestingApis-Key", "YOUR_API_KEY")
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.StatusCode, string(data))
}

POSThttps://api.testingapis.com/api/auth/oauth1

Query

Headers

oauth_consumer_keyrequiredstring

oauth_tokenstring

oauth_signature_methodrequiredstring

oauth_signaturerequiredstring

oauth_timestampstring

oauth_noncestring

oauth_versionstring

Body

status