OAuth 1.0

OAuth 1.0 is an authorization framework that enables third-party applications to access protected resources without exposing user credentials. While largely superseded by OAuth 2.0, OAuth 1.0 is still used by some legacy services and APIs.

OAuth 1.0 uses a signature mechanism to verify the integrity and authenticity of requests, along with timestamps and nonces to prevent replay attacks. Tokens and keys are only known to authorized applications and service providers, ensuring secure communication.

Legacy Protocol

OAuth 1.0 is considered legacy. Most modern APIs use OAuth 2.0. Only use OAuth 1.0 when required by your API provider (e.g., Twitter API v1.1).

Basic Settings

On the Auth page, select OAuth 1.0 as the authorization method and configure the following parameters:

Parameter	Description	Purpose
Add Location	Where to include auth data	Choose `Request Body/Request URL` or `Request Header`
Signature Method	Cryptographic algorithm	`HMAC-SHA1`, `HMAC-SHA256`, `HMAC-SHA512`, `RSA-SHA1`, `RSA-SHA256`, `RSA-SHA512`, or `PLAINTEXT`
Consumer Key	Application identifier	Unique ID assigned by the service provider
Consumer Secret	Application secret key	Secret assigned by the service provider
Access Token	User authorization token	Token issued after user authorizes the application
Token Secret	Token secret string	Secret associated with the access token for signature creation

Signature Methods

HMAC-based: Most common, uses shared secrets

RSA-based: Uses public/private key pairs, more secure but complex

PLAINTEXT: Not recommended for production (no encryption)

Advanced Settings

Click the Advanced option to configure additional OAuth 1.0 parameters. If left blank, they will be automatically generated.

Parameter	Description	Purpose
Callback URL	Redirect URL after authorization	Where the user is redirected after authorizing the application
Verifier	Verification code	Random string to verify user authorization (generated by service provider)
Timestamp	Unix timestamp	Prevents replay attacks by marking request time
Nonce	Random unique string	Prevents replay attacks by uniquely identifying each request
Version	OAuth version	Default value, typically no change needed
Realm	Security domain	Identifies the scope of the protected resource

Additional Options

Include body hash: When enabled, includes a hash of the request body in the signature

Add empty parameters to signature: When enabled, includes empty parameters in signature calculation

Automatic Generation

Apidog automatically generates Timestamp and Nonce values if left blank, ensuring proper security without manual configuration.

Basic Settings#

Advanced Settings#

Additional Options#

Basic Settings

Advanced Settings

Additional Options