title: What is wrong with my ETrade OAuth get token request?
body: <p>The server is responding with a less than helpful message.</p>
  
  <blockquote>
    <p>Unable to get a request token: Request for <a href="https://etwssandbox.etrade.com/oauth/sandbox/request_token?oauth_callback=oob&amp;oauth_consumer_key=aaf0812a4bcc6e4c21783af47cf88237&amp;oauth_nonce=3495463522&amp;oauth_signature=ykqRaZc18GwIoqHtYqtxzsMq4xs%3D&amp;oauth_signature_method=HMAC-SHA1&amp;oauth_timestamp=1371092839&amp;oauth_version=1.0" rel="nofollow">https://etwssandbox.etrade.com/oauth/sandbox/request_token?oauth_callback=oob&amp;oauth_consumer_key=aaf0812a4bcc6e4c21783af47cf88237&amp;oauth_nonce=3495463522&amp;oauth_signature=ykqRaZc18GwIoqHtYqtxzsMq4xs%3D&amp;oauth_signature_method=HMAC-SHA1&amp;oauth_timestamp=1371092839&amp;oauth_version=1.0</a> failed,HTTP/1.1 400 Bad Request</p>
  </blockquote>
  
  <pre><code>Connection: close
  Content-Length: 62
  Client-Date: Thu, 13 Jun 2013 03:07:19 GMT
  Client-Peer: 12.153.224.230:443
  Client-Response-Num: 1
  Client-SSL-Cert-Issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
  Client-SSL-Cert-Subject: /C=US/ST=New York/L=New York/O=ETRADE FINANCIAL CORPORATION/OU=Global Information Security/CN=etwssandbox.etrade.com
  Client-SSL-Cipher: RC4-MD5
  
  &lt;html&gt;&lt;body&gt;&lt;b&gt;Http/1.1 400 Bad Request&lt;/b&gt;&lt;/body&gt; &lt;/html&gt;
  </code></pre>
  
  <h2>OK I will try with headers. All required parameters are present.</h2>
  
  <blockquote>
    <p>$ wget -d -O- --header='Authorization: OAuth realm="",oauth_callback="oob",oauth_consumer_key="aaf0812a4bcc6e4c21783af47cf88237",oauth_nonce="3495463522",oauth_signature="ykqRaZc18GwIoqHtYqtxzsMq4xs%3D",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1371092839",oauth_version="1.0"' '<a href="https://etwssandbox.etrade.com/oauth/sandbox/request_token" rel="nofollow">https://etwssandbox.etrade.com/oauth/sandbox/request_token</a>'                                                                     </p>
  </blockquote>
  
  <pre><code>Setting --output-document (outputdocument) to -
  Setting --header (header) to Authorization: OAuth realm="",oauth_callback="oob",oauth_consumer_key="aaf0812a4bcc6e4c21783af47cf88237",oauth_nonce="3495463522",oauth_signature="ykqRaZc18GwIoqHtYqtxzsMq4xs%3D",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1371092839"
  DEBUG output created by Wget 1.13.4 on cygwin.
  
  URI encoding = `UTF-8'
  --2013-06-12 23:08:33--  https://etwssandbox.etrade.com/oauth/sandbox/request_token
  Resolving etwssandbox.etrade.com (etwssandbox.etrade.com)... 12.153.224.230, 198.93.34.230
  Caching etwssandbox.etrade.com =&gt; 12.153.224.230 198.93.34.230
  Connecting to etwssandbox.etrade.com (etwssandbox.etrade.com)|12.153.224.230|:443... connected.
  Created socket 3.
  Releasing 0x80733128 (new refcount 1).
  
  ---request begin---
  GET /oauth/sandbox/request_token HTTP/1.1
  User-Agent: Wget/1.13.4 (cygwin)
  Accept: */*
  Host: etwssandbox.etrade.com
  Connection: Keep-Alive
  Authorization: OAuth realm="",oauth_callback="oob",oauth_consumer_key="aaf0812a4bcc6e4c21783af47cf88237",oauth_nonce="3495463522",oauth_signature="ykqRaZc18GwIoqHtYqtxzsMq4xs%3D",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1371092839"
  
  ---request end---
  HTTP request sent, awaiting response...
  ---response begin---
  HTTP/1.1 400 Bad Request
  Content-Length:62
  Connection: close
  
  ---response end---
  400 Bad Request
  2013-06-12 23:08:34 ERROR 400: Bad Request.
  </code></pre>
  
  <h3>That still did not work. Let me verify the signature. Notice my key and secret are correct.</h3>
  
  <h3>First URL encode all the parameters to form a base string for signing.</h3>
  
  <blockquote>
    <p>$ perl -MURI::Escape -e "print uri_escape('oauth_callback=oob&amp;oauth_consumer_key=aaf0812a4bcc6e4c21783af47cf88237&amp;oauth_nonce=3495463522&amp;oauth_signature_method=HMAC-SHA1&amp;oauth_timestamp=1371092839&amp;oauth_version=1.0')"                                               </p>
    
    <p>oauth_callback%3Doob%26oauth_consumer_key%3Daaf0812a4bcc6e4c21783af47cf88237%26oauth_nonce%3D3495463522%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1371092839%26oauth_version%3D1.0</p>
  </blockquote>
  
  <h3>Now hash with HMAC-SHA1, encode with Base64 (no newline at end), and URL encode the resulting signature.</h3>
  
  <h3>There is an ampersand at the end of the consumer secret because we don't have a token secret yet (it is empty).</h3>
  
  <blockquote>
    <p>$ perl -MDigest::HMAC_SHA1=hmac_sha1 -MMIME::Base64 -MURI::Escape -e "print uri_escape(encode_base64(hmac_sha1('GET&amp;https%3A%2F%2Fetwssandbox.etrade.com%2Foauth%2Fsandbox%2Frequest_token&amp;oauth_callback%3Doob%26oauth_consumer_key%3Daaf0812a4bcc6e4c21783af47cf88237%26oauth_nonce%3D3495463522%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1371092839%26oauth_version%3D1.0', 'xxxxxxxxxxxxxxxxxxxx&amp;'), ''))"</p>
  </blockquote>
  
  <pre><code>ykqRaZc18GwIoqHtYqtxzsMq4xs%3D
  </code></pre>
  
  <h3>This signature matches the above.</h3>
  
  <p>The specs are here: <a href="http://oauth.net/core/1.0a/#signing_process" rel="nofollow">http://oauth.net/core/1.0a/#signing_process</a></p>
  
  <p>ETrade specs are here: <a href="https://us.etrade.com/ctnt/dev-portal/getDetail?contentUri=V0_Documentation-AuthorizationAPI-GetRequestToken" rel="nofollow">https://us.etrade.com/ctnt/dev-portal/getDetail?contentUri=V0_Documentation-AuthorizationAPI-GetRequestToken</a></p>