Skip to main content

OAuth 1.0

OAuth 1.0 is a legacy authentication protocol still used by some APIs (notably Twitter v1.1 API). It signs each request with an HMAC signature.

Setup​

  1. Select OAuth 1.0 from the Auth type dropdown
  2. Fill in:
FieldDescription
Consumer KeyYour OAuth 1.0 consumer key (API key)
Consumer SecretYour OAuth 1.0 consumer secret
Access TokenOAuth access token
Token SecretOAuth token secret
Signature MethodHMAC-SHA1 (default) or PLAINTEXT
Add params toHeader (recommended) or Query Params

How it Works​

Rostyman computes and signs the request in the Electron main process. The signature covers:

  • HTTP method
  • Request URL
  • All parameters (OAuth params + query params)
  • Timestamp and nonce (generated automatically per request)

The resulting Authorization: OAuth ... header is added automatically.

Signature Methods​

MethodSecurity
HMAC-SHA1Standard — use this for most APIs
PLAINTEXTNo hashing — only use over HTTPS

Variables​

All fields support {{variables}}:

Consumer Key:    {{oauthConsumerKey}}
Consumer Secret: {{oauthConsumerSecret}}
Access Token:    {{oauthToken}}
Token Secret:    {{oauthTokenSecret}}