Getting "Invalid OAuth Request" with signed requests...

[Alexander]

Here's my header:

```
OAuth oauth_consumer_key="MYCONSUMERKEY", oauth_nonce="2gz0uT7EJTxUEhG1gi3KqnusjDRtzEvK", oauth_signature="nQW6bAOtl8kT9lfMqinodR695DI%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1458366768", oauth_token="MYTOKEN", oauth_version="1.0"
```

[Daniel]

That's actually the header, and it looks ok to me. Try to find the actual signature base string and check it against this: http://oauth.googlecode.com/svn/code/...

[Alexander]

Alright, was able to determine the difference between the two:

GET&https%3A%2F%2Fwww.goodreads.com%2Fapi%2Fauth_user&a...

GET&https%3A%2F%2Fwww.goodreads.com%2Fapi%2Fauth_user&a...

The library I'm using is putting `oauth_verifier` in with the base string, whereas the google tool does not.

[Daniel]

Yep, that could be the cause of your problem, I think. I'd try getting it out of there or using a different library.

[Alexander]

I guess one concern I have is that this isn't the first situation where your API isn't abiding by the oauth specification. I'm definitely not going to change my library (phpleague is responsible for a number of very high quality PHP packages).

The library I'm using follows the specification quite closely and generally speaking if something is out of place, it's because the server I'm contacting is going outside of the spec.

Have you guys considered auditing your API and coming up with a version that follows the oauth spec properly?

[Alexander]

@Daniel

So I've produced a custom driver for the library - at least in my project - that is able to work around the quirks in the goodreads API, you can find it here:

https://github.com/thephpleague/oauth...

This has me now able to generate signed requests based on some of the inconsistencies, but perhaps it can serve as an informational document to help improve your service.

Overall, just look for my double-slashed comments in the code and they explain why I'm manipulating things a certain way.

[Daniel]

Oh, I don't work for Goodreads and I totally agree, the API is terrible, haha. I'm just trying to help.

But in your case, to be fair, I really don't think the auth_verifier parameter should be there. I don't know that much about OAuth, but from what I gathered that's only included when authorizing and getting a token, not when making a regular request.
I've compared my signature base strings to the ones generated by the link I posted and when I got them to match everything worked reasonably well, albeit with a few bumps.

[Alexander]

Yeah, I think I've basically just codified all their quirks with that file, so whenever they get around to this thread, it's waiting for them.

Sorry, thought you were goodreads staff due to your promptness ;)

[Daniel]

Quite on the contrary, the promptness is a clear sign I'm not Goodreads staff, haha. I'm just trying to figure out the api too, so I've been hanging around here.
Good luck. :)