I have the following query:

$url = http://kostakfashion.com/rest/V1/products/?searchCriteria[filter_groups][0][filters][0][field]=category_gear&searchCriteria[filter_groups][0][filters][0][value]=10&searchCriteria[filter_groups][0][filters][0][condition_type]=finset;

Without searchCriteria it works well. But if i add searchCriteria , I have an error

string(31) "{"message":"Invalid signature"}"

I use OAuth authentication . How could i fix it any idea ?


Looks like solution is found for me magento rest api V1/products endpoint

Just use this lib https://github.com/springimport/magento2-api-v1 It simplifies everything greatly!


This error comes from the Magento\Framework\Oauth\Oauth class and it means that calculated on the magento side signature IS NOT EQUAL to the signature from the authorization request. You can debug it in the method _validateSignature (lines ~ 177-203). Here is the method:

 * Validate signature based on the signature method used.
 * @param array $params
 * @param string $consumerSecret
 * @param string $httpMethod
 * @param string $requestUrl
 * @param string $tokenSecret
 * @return void
 * @throws Exception|OauthInputException
protected function _validateSignature($params, $consumerSecret, $httpMethod, $requestUrl, $tokenSecret = null)
    if (!in_array($params['oauth_signature_method'], self::getSupportedSignatureMethods())) {
        throw new OauthInputException(
            new Phrase(
                'Signature method %1 is not supported',

    $allowedSignParams = $params;

    $calculatedSign = $this->_httpUtility->sign(

    if (!Security::compareStrings($calculatedSign, $params['oauth_signature'])) {
        throw new Exception(new Phrase('Invalid signature'));

The $params comes here from the initial request and it stores an info like: tokens, signature, nonce etc.

auth example oath rest

First you should check your credentials on the another side: if you are using some kind of programs like Postman, may be it stored an old tokens. In this case just add a new info from the integration (tokens) and regenerate nonce.

If this does not help you, use xdebug and compare all params one by one, as it can be a typo in the one parameter.

PS: on the screenshot in left-bottom side you can see: what methods has been called in which order, may be it can help you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.