title: vector api, 401 http error code, Signature mismatch. Authorization signature or client credential is wrong
body: <p>I'm trying to use the <a href="https://developer.here.com/documentation/vector-tiles-api/dev_guide/index.html" rel="nofollow noreferrer">here maps vector-tiles api</a>. I've received my credentials from <a href="https://developer.here.com/login" rel="nofollow noreferrer">developer.here.com</a>. I created an app for <code>HERE SDK for Android or iOS (Lite Edition)</code>. I then created credentials, and am using <code>here.access.key.id</code> for my key and <code>here.access.key.secret</code> for my secret.</p>
  
  <p>I'm using the <code>oauth-sign</code> <a href="https://www.npmjs.com/package/oauth-sign" rel="nofollow noreferrer">npm package</a> (which as ~14.5MM weekly downloads at the time of writing this question, so I think it should be working properly) with the following code snippet:</p>
  
  <pre class="lang-js prettyprint-override"><code>import { hmacsign256 } from 'oauth-sign'
  
  export const API_URL = 'https://account.api.here.com/oauth2/token'
  export const nonceLength = 2**5
  
  export interface TokenResponse {
    AccessToken: string
    TokenType: string
    ExpiresIn: number
  }
  
  export const generateNonce = (length: number): string =&gt; {
    let s = ''
    do {
      s += Math.random().toString(36).substr(2)
    } while (s.length &lt; length)
    return s.substr(0, length)
  }
  
  export const fetchNewTokenFromAPI = async ({ key, secret }: { key: string, secret: string }): Promise&lt;TokenResponse&gt; =&gt; {
    const url = API_URL
    const method = 'POST'
    const body = 'grant_type=client_credentials'
    const auth = {
      oauth_consumer_key: key,
      oauth_nonce: generateNonce(nonceLength),
      oauth_signature_method: 'HMAC-SHA256',
      oauth_timestamp: String(Math.round(new Date().getTime() / 1000)),
      oauth_version: '1.0',
    }
  
    const sig = encodeURIComponent(hmacsign256(method, API_URL, auth, key, secret))
    const headers = {
      'Content-Type': 'application/x-www-form-urlencoded',
      'Authorization': `OAuth oauth_consumer_key="${auth['oauth_consumer_key']}",oauth_nonce="${auth['oauth_nonce']}",oauth_signature="${sig}",oauth_signature_method="HMAC-SHA256",oauth_timestamp="${auth['oauth_timestamp']}",oauth_version="1.0"`
    }
  
    const options: RequestInit = {
      method,
      headers,
      body,
      mode: 'cors',
    }
  
    const response = await fetch(url, options)
    if (response.ok)
      throw new Error(`expected 200 status, received ${response.status}`)
  
    return await response.json()
  }
  
  </code></pre>
  
  <p>When I run that function, I recieve the following from the api:</p>
  
  <pre><code>{
    "error": "invalid_client"
    "errorCode": 401300
    "errorId": "ERROR-32e365d0-11ce-4fff-86d7-5ca51970e017"
    "error_description": "errorCode: '401300'. Signature mismatch. Authorization signature or client credential is wrong."
    "httpStatus": 401
    "message": "Signature mismatch. Authorization signature or client credential is wrong."
  }
  </code></pre>