title: OAuth signature generating (PHP)
body: <p>I am not very familiar with the OAuth flow and/or encoding, but I've managed to get my site (somewhat) working as an OAuth provider.</p>
  
  <p>I am saying <strong>somehow</strong>, because for a long time I was getting the "Invalid signature" error when using the access token to fetch the protected information (I successfully got a request token, authorized it and got the access token).</p>
  
  <p>So I looked a little over the signature generation method (I am using Drupal 7 and some undocumented modules). The code is:</p>
  
  <pre><code>public function build_signature($request, $consumer, $token) {
    $base_string = $request-&gt;get_signature_base_string();
    $request-&gt;base_string = $base_string;
  
    $key_parts = array(
      $consumer-&gt;secret,
      ($token) ? $token-&gt;secret : "" // the token object has a key and a secret property
    );
  
    $key_parts = OAuthUtil::urlencode_rfc3986($key_parts);
    $key = implode('&amp;', $key_parts);
  
    return base64_encode(hash_hmac($this-&gt;algo, $base_string, $key, TRUE));
  }
  </code></pre>
  
  <p>So this is using the <code>$token</code> secret to generate the signature for the request (plus the <code>$base_string</code> which is not important).</p>
  
  <p>So I am guessing my question really is: does an application (client) that uses my OAuth, need to know the access token secret in order to be working? Is the secret a public information (am guessing not, hence the name). What am I doing wrong here?</p>