E-trade: requesting access token, I get signature invalid

Question

1st. step, getting url to verify, and verifier is ok.

Using the same method that in the request_token to sign the request, I get "unauthorized", "oauth_problem = signature invalid".

I verify the code letter by letter, and I can't find the problem.

1. step, request token -> OK
2. Get verifier code in the url -> OK
3. Generating the access_token, signature invalid.

I had serveral functions, but I put the code readable in a single function to find the problem:

public void GetAccessToken(string oauthVerifier)
    {
        IRestResponse response;

        RestClient client = new RestClient(apiURI);
        string timeStamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString();
        string atNonce = Guid.NewGuid().ToString();


        RestRequest request = new RestRequest(GET_ACCESS_TOKEN_URL, Method.GET);

        request.AddParameter("oauth_consumer_key", consumerKey);
        request.AddParameter("oauth_timestamp", timeStamp);
        request.AddParameter("oauth_nonce", atNonce);
        request.AddParameter("oauth_signature_method", SIGNATURE_METHOD);
        request.AddParameter("oauth_signature", "");
        request.AddParameter("oauth_token", token);
        request.AddParameter("oauth_verifier", oauthVerifier);

        //var parameters = new SortedDictionary<string, string>();


        var parameters = new SortedDictionary<string, string>
        {
            {"oauth_consumer_key", consumerKey},
            {"oauth_timestamp", timeStamp},
            {"oauth_nonce", atNonce},
            {"oauth_signature_method", SIGNATURE_METHOD},
            { "oauth_token", token },
            { "oauth_verifier", oauthVerifier }
        };

        var sb = new StringBuilder();
        sb.Append("GET");
        sb.Append("&" + WebUtility.UrlEncode(apiURI + GET_ACCESS_TOKEN_URL));
        sb.Append("&" + WebUtility.UrlEncode(NormalizeParameters(parameters)));

        var signatureBase = sb.ToString();
        var signatureKey = string.Format("{0}&{1}", WebUtility.UrlEncode(consumerSecret), WebUtility.UrlEncode(tokenSecret));

        var hmac = new HMACSHA1(Encoding.ASCII.GetBytes(signatureKey));
        string signature = Convert.ToBase64String(hmac.ComputeHash(Encoding.ASCII.GetBytes(signatureBase)));

        request.Parameters[4].Value = signature;


        response = client.Execute(request);
    }

The response variable get "unauthorized" because the "signature_invalid".

Any help is welcome, thank you in advance!

Update 1

Oauth documentation says that the signature have to be urlencoded too, then I after convert it to base 64 string, I urlencode it too:

request.Parameters[4].Value = WebUtility.UrlEncode(signature);

Whatever, still returning "signature invalid".

Some light from the sky there? Thank you!

Answer 1

also review this header from E-Trade link, I might have missed out some specifics

Authorization: OAuth oauth_nonce="0bba225a40d1bbac2430aa0c6163ce44",oauth_timestamp="1344885636",oauth_consumer_key="c5bb4dcb7bd6826c7c4340df3f791188",oauth_token="VbiNYl63EejjlKdQM6FeENzcnrLACrZ2JYD6NQROfVI%3D",oauth_signature="%2FXiv96DzZabnUG2bzPZIH2RARHM%3D",oauth_signature_method="HMAC-SHA1"

`public void GetAccessToken(string oauthVerifier) { IRestResponse response;

    RestClient client = new RestClient(apiURI);
    string timeStamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString();
    string atNonce = Guid.NewGuid().ToString();


    RestRequest request = new RestRequest(GET_ACCESS_TOKEN_URL, Method.GET);

    var parameters = new SortedDictionary<string, string>
    {
        {"oauth_consumer_key", consumerKey},
        {"oauth_timestamp", timeStamp},
        {"oauth_nonce", atNonce},
        {"oauth_signature_method", SIGNATURE_METHOD},
        {"oauth_token", token },
        {"oauth_verifier", oauthVerifier }
    };

    var sb = new StringBuilder();
    sb.Append("GET");
    sb.Append("&" + WebUtility.UrlEncode(apiURI + GET_ACCESS_TOKEN_URL));

    //does NormalizeParameters seperate by "&"
    sb.Append("&" + WebUtility.UrlEncode(NormalizeParameters(parameters)));

    var signatureBase = sb.ToString();
    var signatureKey = string.Format("{0}&{1}", WebUtility.UrlEncode(consumerSecret), WebUtility.UrlEncode(tokenSecret));

    var hmac = new HMACSHA1(Encoding.ASCII.GetBytes(signatureKey));
    string signature = Convert.ToBase64String(hmac.ComputeHash(Encoding.ASCII.GetBytes(signatureBase)));

    //encode signature
    signature = "oauth_signature=\"" + WebUtility.UrlEncode(signature) + "\""

    //TODO: generate header_string seperated by ","
    request.AddHeader("Authorization",$"OAuth {<<header_string>>},{signature}");

    response = client.Execute(request);
}`

Answer 2

Are you using the sandbox or live?

Getting it working in the sandbox first is a good step.

After that, you have to get the key from e-trade.

Also, I believe there are sites that will validate your oauth signature that would give you a more informative error.