Invalidate Signature with retrofit

[shazmomin]

I am using retrofit api to make network calls on Android. I am getting invalid signature error

{"errors":[{"errorType":"oauth","fieldName":"oauth_signature","message":"Invalid signature: VVhu8YSABOQy6ce/VsUYQ5fClOk="}],"success":false}

.my signature and base url matches with the one generated by fitbit debug tool. I am trying to add header like this

request.addHeader("Authorization","OAuth"+
" "+"oauth_consumer_key"+"=\"84890ef561084252b44400a403861203\""+","+
"oauth_signature"+"=\""+signature+"\""+","+
"oauth_nonce"+"=\""+nonce+"\""+","+
"oauth_signature_method"+"=\"HMAC-SHA1\""+","+
"oauth_timestamp"+"=\""+System.currentTimeMillis()/1000+"\""+","+
"oauth_version"+"=\"1.0\""); 

retrofit log

HTTP GET http://api.fitbit.com/1/user/2VQXH4/profile.json
Authorization: OAuth oauth_consumer_key="84890ef561084252b44400a403861203",oauth_signature="VVhu8YSABOQy6ce/VsUYQ5fClOk=",oauth_nonce="4",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1413302886",oauth_version="1.0"

the equivalent WORKING curl is

curl -api.fitbit.com/1/user/2VQXH4/profile.json' -H 'Authorization: OAuth oauth_consumer_key="84890ef561000252b44400a403861203", oauth_nonce="4", oauth_signature="VVhu8YSABOQy6ce%2FVsUYQ5fClOk%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1413302886", oauth_token="6a70036760c7444d01579ddd2fb3a0db", oauth_version="1.0"'

 any help where I am going wrong

[shazmomin]

got it working missed token in header

[ibahdanau]

Great. 

Please don't forget to request for a new access token and secret now!

For future I suggest never post on a public forum you keys or secrets.

[shazmomin]

No they were not my original tokens!! I changed them lol, thanks though 🙂

[Ronniea]

It is very easy. you can read it from https://abhiandroid.com/programming/retrofit for further information and will be able to fic your problem.