idangazit/oauthlib — pull request #8 by ib-lundgren (2012-03-15 22:24:11+00:00)
Title: Changed secrets and resource owner key to optional

Client secret and resource owner secret are both optional per spec (http://tools.ietf.org/html/rfc5849#section-3.4.2, see key 2) even if it would make no sense to not use at least one. Both secrets can safely be set to None without affecting HMAC. Also if the request is signed with RSA-SHA1 then none of the secrets will be used.

Resource owner key is only available in step 2 & 3 of the 3 step authentication (http://tools.ietf.org/html/rfc5849#section-2). While it could still be submitted with an empty string as a value I think it is a better idea to leave it out of the parameters altogether.