Home/ Questions/Q 8098005
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-05T21:56:25+00:00

I followed the tutorial on https://dev.twitter.com/docs/auth/implementing-sign-twitter to use OAuth on my homepage. Everything worked

  • 0

I followed the tutorial on https://dev.twitter.com/docs/auth/implementing-sign-twitter to use OAuth on my homepage. Everything worked and after the last step I have an oauth_token (after converting it to an access token) and an oauth_token_secret. Now I want to post a new status on twitter. So I did everything on this page https://dev.twitter.com/docs/auth/authorizing-request which is just a post request to /1/statuses/update.json. On that page nothing is said about the oauth_token_secret, so I haven’t used it in my request and just have put the oauth_token in it. After submitting the post request twitter gives me the status code 401 Unauthorized. Why that? Do I have to use the oauth_token_secret somewhere?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The token secret is used to hash the signature base. Something like a password. You don’t send the password, you use it to compute a secure hash of the thing the service sent to you. You send that secure hash, then the service checks that secure hash against the request you sent. If they match, you’re authorized.

    The gory details are described in the OAuth spec, RFC 5849.

    Twitter uses OAuth1.0a, but is mostly consistent with that spec.

    here’s the relevant bit:

    https://www.rfc-editor.org/rfc/rfc5849#section-3.4.2

    enter image description here

    • 0