I need to generate access token for third party extension in Magento. I create integration, now I should sent request to /oauth/token/request in order to get a request token, but I get following error:


My signature function is as follow

function sign($method, $url, $data, $consumerSecret, $tokenSecret)




    $url = urlEncodeAsZend($url);
    $data = urlEncodeAsZend(http_build_query($array, '', '&'));
    $data = implode('&', $array);
    $secret = implode('&', [$consumerSecret, $tokenSecret]);

    return base64_encode(hash_hmac('sha1', $data, $secret, true));

function urlEncodeAsZend($value)
    $encoded = rawurlencode($value);
    $encoded = str_replace('%7E', '~', $encoded);
    return $encoded;

PS: my oauth_token is empty because in this step no token is created in Integrations.Doc says :

To generate the signature, you must use the HMAC-SHA1 signature method. The signing key is the concatenated values of the consumer secret and token secret separated by the ampersand (&) character (ASCII code 38), even if empty.


I am using Magento 2.3

1 Answer 1


It seems it is Magento's bug.

You can refer to this issue https://github.com/magento/magento2/issues/19159?fbclid=IwAR3D_BJokrXw8qP7cDOOjhF7r3uBSe50D31ej7qWXopQdIPwHqf9OW4PMsc

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.