ApiSkills

Authentication · 12 min

OAuth 1.0a (3-legged)

The older signed-request flow (Twitter-style): request token → authorize → access token.

OAuth 1.0a lets a user authorize an app without sharing their password, using signed requests. It has three legs.

  1. Request token: POST /oauth1/request_token with a signed request → temporary token.
  2. Authorize: the user approves at /oauth1/authorize?oauth_token=... → you get an oauth_verifier.
  3. Access token: POST /oauth1/access_token with the request token + verifier (signed) → your access token.

Every request is signed with HMAC-SHA1 over a canonical "signature base string" (method + URL + sorted params). The consumer key is your App ID; the consumer secret is your API key.

Tip · OAuth 1.0a is fiddly by hand — that is exactly why OAuth2 replaced it. n8n has a native OAuth1 credential; the goal here is to understand the three legs and the signature.