Hi,
I'm trying to authenticate with OAuth and am having trouble getting an auth token. I keep getting the following response.
STATUS CODE:
400 Bad Request
DETAILS:
X-Dns-Prefetch-Control: off
X-Frame-Options: DENY
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
Surrogate-Control: no-store
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate
Pragma: no-cache
Expires: 0
X-Trello-Version: 1.2317.0
X-Trello-Environment: Production
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, PUT, POST, DELETE
Access-Control-Allow-Headers: Authorization, Accept, Content-Type
Access-Control-Expose-Headers: x-rate-limit-api-key-interval-ms, x-rate-limit-api-key-max, x-rate-limit-api-key-remaining, x-rate-limit-api-token-interval-ms, x-rate-limit-api-token-max, x-rate-limit-api-token-remaining
Content-Type: text/plain; charset=utf-8
Content-Length: 17
Date: Mon, 04 Jan 2021 03:34:24 GMT
X-Envoy-Upstream-Service-Time: 71
Expect-Ct: report-uri="https://web-security-reports.services.atlassian.com/expect-ct-report/trello-edge", max-age=86400
Strict-Transport-Security: max-age=63072000; preload
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Server: globaledge-envoy
RETURNED DATA:
Invalid Signature
I'm using a language (AHK) that does NOT have a pre built library for Authorizing with Trello so have built my own.
I don't see it anywhere specified in the Trello docs as to what parameters will be used to generate the signature that will be checked on Trellos end. I believe I am using the correct data as laid out in OAuth 1.0 as specified on the developer page .
The signatutre_base_string I'm generating my signature for is as follows (personal info masked)
GET&https%3A%2F%2Ftrello.com%2F1%2FOAuthGetRequestToken&oauth_callback%3D{CALLBACK_URL}%26oauth_consumer_key%{CONSUMER_KEY_HERE}%26oauth_nonce%3DMjgzNjk3NTcwNDYwNzEzODg3NDIzMjE2Nzg4MzkyNzk%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1609673662%26oauth_version%3D1.0 which generated the following Authorization Header
(personal info masked and added line breaks for readability)
Authorization: OAuth
oauth_callback="{CALLBACK_URL}",
oauth_consumer_key="{CONSUMER_KEY_HERE}",
oauth_nonce="MjgzNjk3NTcwNDYwNzEzODg3NDIzMjE2Nzg4MzkyNzk",
oauth_signature="GR7Zk6bT2PaxjYpEzsdVAAi3CCc%3D",
oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1609673662",
oauth_version="1.0"
I'm sure that I'm generating the signature correctly as I get the exact same signature when using any of the online HMAC-SHA1 signature generators.
I'm thinking that I might be missing some kind of required parameter that Trello is including when they generate the signature for verification.
Is there any document that lays out exactly what parameters need to be returned for the authorization? or what the header is expected to look like/contain?
Thanks
