# OAuth 1.0


OAuth 1.0 authentication signs requests cryptographically using consumer credentials and access tokens. While largely replaced by OAuth 2.0, some APIs (like Twitter's v1.1 API) still require OAuth 1.0.

## How It Works

OAuth 1.0 creates a signature from request parameters, consumer credentials, and tokens. The signature is sent in the `Authorization` header:

```
Authorization: OAuth oauth_consumer_key="...", oauth_signature="...", ...
```

Each request includes a unique nonce and timestamp to prevent replay attacks.

## Configuration

Select **OAuth 1.0** from the Auth dropdown. Configure these fields:

| Field | Description |
|-------|-------------|
| **Signature Method** | Algorithm for signing (HMAC-SHA1, HMAC-SHA256, RSA-SHA1, etc.) |
| **Consumer Key** | Your application's consumer key |
| **Consumer Secret** | Your application's consumer secret |
| **Access Token** | User's access token |
| **Token Secret** | Secret associated with the access token (for HMAC methods) |
| **Private Key** | RSA private key in PEM format (for RSA methods) |

## Signature Methods

Yaak supports multiple signature algorithms:

**HMAC-based** (symmetric):
- HMAC-SHA1 (most common)
- HMAC-SHA256
- HMAC-SHA512

**RSA-based** (asymmetric):
- RSA-SHA1
- RSA-SHA256
- RSA-SHA512

**Other**:
- PLAINTEXT (not recommended for production)

For HMAC methods, provide the Consumer Secret and Token Secret. For RSA methods, provide your private key in PEM format instead.

## Advanced Options

Expand **Advanced** for additional settings:

| Field | Description |
|-------|-------------|
| **Callback URL** | OAuth callback URL for authorization flows |
| **Verifier** | Verification code from authorization |
| **Timestamp** | Custom timestamp (auto-generated if empty) |
| **Nonce** | Custom nonce (auto-generated if empty) |
| **OAuth Version** | Protocol version (default: 1.0) |
| **Realm** | Authentication realm |

## Usage

1. Select **OAuth 1.0** from the Auth dropdown
2. Choose your signature method
3. Enter your consumer credentials
4. Add access token and token secret (or private key for RSA)
5. Send your request—Yaak signs it automatically

## Template Variables

Use environment variables for credentials:

```
Consumer Key: ${[ OAUTH1_CONSUMER_KEY ]}
Consumer Secret: ${[ OAUTH1_CONSUMER_SECRET ]}
```

## Troubleshooting

**Invalid Signature**
- Verify all credentials are correct
- Check that the signature method matches what the API expects
- Ensure your system clock is accurate

**Timestamp Rejected**
- OAuth 1.0 requires timestamps within a few minutes of server time
- Check your system clock synchronization

**Nonce Already Used**
- Each request needs a unique nonce
- Let Yaak auto-generate nonces (leave the field empty)