title: Create OAuth Signature with HMAC-SHA1 Encryption returns HTTP 401
body: <p><strong>The Question</strong><br />
  I need to authenticate to an API which needs OAuth encryption.</p>
  <p>I'm in the right direction but I am sure something is wrong with my signature base string. Since the HMACSHA1 Hash is based on a Key and BaseString, I get a wrong oauth_signature.</p>
  <p><a href="http://oauth.net/core/1.0a/#signing_process" rel="nofollow noreferrer">OAuth Signing Process</a></p>
  <p><strong>So far</strong><br />
  I have been able to collect all the required pieces of data, which includes:</p>
  <blockquote>
  <ul>
  <li>Consumer Key</li>
  <li>Consumer Secret</li>
  <li>Acces Token</li>
  <li>Acces Secret</li>
  <li>Sha1Hased Value (Based on Key and Message, where Message is the signature Base string)</li>
  <li>Signature Base String</li>
  </ul>
  </blockquote>
  <p><strong>The Problem</strong><br />
  I get a HTTP(401 Bad Request) returned because of a invalid signature.</p>
  <p><strong>note:</strong> I'm pretty sure it is how I build my <strong>Signature Base String</strong>. For info about the API Docs I used, please check bottom page.</p>
  <p><strong>The Code</strong></p>
  <p><strong>GetOAuthToken</strong> (Doing the actual request)</p>
  <pre><code>public static string GetAuthorizationToken()
  {
      string TimeInSecondsSince1970 = ((int)(DateTime.UtcNow - new DateTime(1970, 1, 1)).TotalSeconds).ToString();
      string Nonce = System.Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(TimeInSecondsSince1970
      + TimeInSecondsSince1970 + TimeInSecondsSince1970));
      HttpWebRequest httpWebRequest = (HttpWebRequest)WebRequest.Create(GetAppleApiUrl.GetUrl(AppleApiUrl.SESSION_TOKEN));
      httpWebRequest.Method = &quot;GET&quot;;
  
      string consumer_secret = Uri.EscapeDataString(Settings.SettingsManager.consumer_secret);
      string token_secret = Uri.EscapeDataString(Settings.SettingsManager.access_secret);
  
      string signature_base_string = GetSignatureBaseString(TimeInSecondsSince1970, Nonce);
      string SHA1HASH = GetSha1Hash(consumer_secret + &quot;&amp;&quot; + token_secret, signature_base_string);
                  
      string Header =
         &quot;OAuth realm=&quot; + '&quot;' + &quot;ADM&quot; + '&quot;' + &quot;,&quot; +
         &quot;oauth_consumer_key=&quot; + '&quot;' + Settings.SettingsManager.consumer_key + '&quot;' + &quot;,&quot; +
         &quot;oauth_token=&quot; + '&quot;' + Settings.SettingsManager.access_token + '&quot;' + &quot;,&quot; +
         &quot;oauth_signature_method=&quot; + '&quot;' + &quot;HMAC-SHA1&quot; + '&quot;' + &quot;,&quot; +
         &quot;oauth_signature= &quot; + '&quot;' + SHA1HASH + '&quot;' + &quot;,&quot; + 
         &quot;oauth_timestamp=&quot; + '&quot;' + TimeInSecondsSince1970 + '&quot;' + &quot;,&quot; +
         &quot;oauth_nonce=&quot; + '&quot;' + Nonce + '&quot;' + &quot;,&quot; +
         &quot;oauth_version=&quot; + '&quot;' + &quot;1.0&quot; + '&quot;' + &quot;,&quot;;
     
      httpWebRequest.Headers.Add(HttpRequestHeader.Authorization, Header);
      var Result = httpWebRequest.GetResponse();
  
      return Result.ToString();
  }
  </code></pre>
  <p><strong>GetSha1Hash</strong></p>
  <pre><code>public static string GetSha1Hash(string key, string message)
  {
      var encoding = new System.Text.ASCIIEncoding();
  
      byte[] keyBytes = encoding.GetBytes(key);
      byte[] messageBytes = encoding.GetBytes(message);
  
      string Sha1Result = string.Empty;
  
      using (HMACSHA1 SHA1 = new HMACSHA1(keyBytes))
      {
          var Hashed = SHA1.ComputeHash(messageBytes);
          Sha1Result = Convert.ToBase64String(Hashed);
      }
  
      return Sha1Result;
  }
  </code></pre>
  <p><strong>GetSignatureBaseString</strong></p>
  <pre><code>public static string GetSignatureBaseString(string TimeStamp, string Nonce)
  {
      //1.Convert the HTTP Method to uppercase and set the output string equal to this value.
      string Signature_Base_String = &quot;Get&quot;;
      Signature_Base_String = Signature_Base_String.ToUpper();
  
      //2.Append the ‘&amp;’ character to the output string.
      Signature_Base_String = Signature_Base_String + &quot;&amp;&quot;;
  
      //3.Percent encode the URL and append it to the output string.
      string PercentEncodedURL = Uri.EscapeDataString(GetAppleApiUrl.GetUrl(AppleApiUrl.SESSION_TOKEN));
      Signature_Base_String = Signature_Base_String + PercentEncodedURL;
  
      //4.Append the ‘&amp;’ character to the output string.
      Signature_Base_String = Signature_Base_String + &quot;&amp;&quot;;
  
      //5.append parameter string to the output string.
      Signature_Base_String = Signature_Base_String + Uri.EscapeDataString(&quot;oauth_consumer_key=&quot; + Settings.SettingsManager.consumer_key);
      Signature_Base_String = Signature_Base_String + Uri.EscapeDataString(&quot;&amp;oauth_token=&quot; + Settings.SettingsManager.access_token);
      Signature_Base_String = Signature_Base_String + Uri.EscapeDataString(&quot;&amp;oauth_signature_method=&quot; +&quot;HMAC-SHA1&quot;);
      Signature_Base_String = Signature_Base_String + Uri.EscapeDataString(&quot;&amp;oauth_timestamp=&quot; + TimeStamp);
      Signature_Base_String = Signature_Base_String + Uri.EscapeDataString(&quot;&amp;oauth_nonce=&quot; + Nonce);
      Signature_Base_String = Signature_Base_String + Uri.EscapeDataString(&quot;&amp;oauth_version=&quot; + &quot;1.0&quot;);
  
      return Signature_Base_String;
  }
  </code></pre>
  <p><em><strong>Result (Fiddler)</strong></em>
  <a href="https://i.stack.imgur.com/RopzT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/RopzT.png" alt="Fiddler Result" /></a></p>
  <p><em><strong>API Doc</strong></em>
  <a href="https://i.stack.imgur.com/RaZkj.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/RaZkj.png" alt="enter image description here" /></a></p>