Getting Invalid Signature error for OAuthGetRequestToken - How to fix?
Asked by AravindhanSundaram:

Hi,  
Are there any recent changes in OAuthGetRequestToken? It was working fine for months, but suddenly I am getting (400 - Invalid Signature) this error.

**Request Url:**

[https://trello.com/1/OAuthGetRequestToken?scope=r+e+a+d+%2C+w+r+i+t+e\&oauth_callback=http%3A%2F%2Flocalhost%3A8000%2Faccounts%2Ftrello%2Flogin%2Fcallback%2F](https://trello.com/1/OAuthGetRequestToken?scope=r+e+a+d+%2C+w+r+i+t+e&oauth_callback=http%3A%2F%2Flocalhost%3A8000%2Faccounts%2Ftrello%2Flogin%2Fcallback%2F)

**Method:** POST

**Params:**   
(personal info masked and added line breaks for readability)

```
Authorization: OAuth 1.0
oauth_callback="http://localhost:8000/accounts/trello/login/callback/",
oauth_consumer_key="ed35XXXXXXXXXXXXXXXXXXXXXc12b",
oauth_nonce="a30vQMPpr4w",
oauth_signature="a3Qh3D4KvI43NwvZmgjc%2FkrTrr0%3D",
oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1665735825",
oauth_version="1.0"
```

**Request Headers:**  

```
{

'Date': 'Fri, 14 Oct 2022 08:32:06 GMT', 

'Content-Type': 'text/plain; charset=utf-8', 

'Content-Length': '17', 

'X-Dns-Prefetch-Control': 'off', 

'X-Frame-Options': 'DENY', 

'X-Download-Options': 'noopen', 

'X-Permitted-Cross-Domain-Policies': 'none', 

'Referrer-Policy': 'strict-origin-when-cross-origin', 

'Surrogate-Control': 'no-store', 

'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate', 

'Pragma': 'no-cache', 

'Expires': '0', 

'X-Trello-Version': '1.163591.0', 

'X-Trello-Environment': 'Production (Micros)', 

'Access-Control-Allow-Origin': '*', 

'Access-Control-Allow-Methods': 'GET, PUT, POST, DELETE', 

'Access-Control-Allow-Headers': 'Authorization, Accept, Content-Type', 

'Access-Control-Expose-Headers': 'x-rate-limit-api-key-interval-ms, x-rate-limit-api-key-max, x-rate-limit-api-key-remaining, x-rate-limit-api-token-interval-ms, x-rate-limit-api-token-max, x-rate-limit-api-token-remaining', 

'X-Envoy-Upstream-Service-Time': '219', 

'Server': 'globaledge-envoy', 

'Expect-Ct': 'report-uri="https://web-security-reports.services.atlassian.com/expect-ct-report/trello-edge", max-age=86400', 

'Strict-Transport-Security': 'max-age=63072000; preload', 

'X-Content-Type-Options': 'nosniff', 

'X-Xss-Protection': '1; mode=block', 

'Atl-Traceid': '8dd9c171c70391a3', 

'Report-To': '{

 "endpoints": [

 {"url": "https://dz8aopenkvv6s.cloudfront.net"}

 ], 

 "group": "endpoint-1", 

 "include_subdomains": true, "max_age": 600

 }', 

'Nel': '{

 "failure_fraction": 0.001, 

 "include_subdomains": true, 

 "max_age": 600, 

 "report_to": "endpoint-1"

 }'

} 
```

**Status Code:**400 Bad Request

**Response Text:**Invalid Signature

I am using django-allauth library for Authorizing with Trello, which was working fine. Recently, I am getting "400 - invalid signature". I tested using postman, same result.

I'm thinking that I might be missing some kind of required parameter that Trello is included recently when they generate the signature for verification.

Is there any document that lays out exactly what parameters need to be returned for the authorization? or what the header is expected to look like/contain?

Thanks


Answers:
author: Alex W
body: Hey [@AravindhanSundaram](/t5/user/viewprofilepage/user-id/5053908) - I recommend raising this at <https://community.developer.atlassian.com/c/trello/42> - they'll be better suited to assist you with this.

comments: author: AravindhanSundaram
body: Hi [@Alex _ Trello](/t5/user/viewprofilepage/user-id/4469170)

Thank you for the recommendation. I will post there.


Tags: api

authentication

oauth

rest-api