In two-leggged oauth a defined token is not required. It's required when a user is participating in the third oauth leg. In two-legged oauth it's required that an empty token is passed to the comsumer (3.1 in http://oauth.googlecode.com/svn/spec/ext/consumer_request/1.0/drafts/2/spec.html), also checkout (http://stackoverflow.com/questions/4768132/google-data-api-two-legged-auth-token-reuse). I think the token preparation should match the treeherder-client token preparation https://github.com/mozilla/treeherder-client/blob/master/thclient/client.py#L611. Authentication is verified by the consumer signing the request with the shared secret. A comment indicating that's what's happening here would be useful because it does look odd when reading the code.