Question

When requesting authorization (or whatever other type of request), should the parameters oauth_tokenand oauth_signature be sent via querystring or by adding them as values in your HttpWebRequest.Header as a NameValueCollection additions to the header?

Answer 1

Based on their example ruby code they are looking for it in the header.

consumer = OAuth::Consumer.new(
        "API_CONSUMER_KEY",
        "API_CONSUMER_SECRET",
        :site => "https://yoursite.Desk.com",
        :scheme => :header
)

The oauth_token and oauth_signature (along with all of the other params that start with oauth_) would all go in the authorization http header as comma seperated name value pairs as shown here https://www.rfc-editor.org/rfc/rfc5849#section-3.5.1

Here’s a quick example using the DevDefined.OAuth library…

var endPoint = new Uri("https://yoursite.Desk.com");
var ctx = new OAuthConsumerContext
{
    ConsumerKey = "consumerkey1",
    ConsumerSecret = "consumersecret1",
    SignatureMethod = SignatureMethod.HmacSha1
};

var session = new OAuthSession(ctx, endPoint);
session.AccessToken = new TokenBase
{
    Token = "ACCESS_TOKEN",
    TokenSecret = "ACCESS_TOKEN_SCRET"
};

var respText = session.Request().Get().ForUri(endPoint).ToString();