Magento 2 REST API Endpoint /V1/stockItems/:productSku is encountering a bug specifically when using OAuth 1.0 authentication. The issue arises when the product SKU contains special characters such as slashes (/) or ampersands (&). This results in an incorrect OAuth signature being generated, leading to errors in the authentication process.

The error is being triggered from the class Magento\Framework\Oauth\Oauth::_validateSignature() at line number 207. The root cause of the problem lies in the signature generation process, which is performed by the Laminas library. The library generates different signatures for SKUs containing slashes or ampersands, causing inconsistencies in the authentication flow.

Example: Working URL: https://test.com/test-sku Not Working URL: https://test.com/test-sku%2F123

The correct OAuth signature generation for the product SKU is not taking into account the special characters, leading to an incorrect signature that fails the authentication process.

To fix this issue, adjustments need to be made in the OAuth signature generation logic, ensuring that it properly handles SKUs with special characters and produces consistent signatures for all SKU variations.

Please see below screenshot for more reference.

enter image description here

Steps to reproduce

  • Login to Magento admin. Navigate to System > Extensions > Integrations > Add New Integration.
  • Activate Added Integration from the Integration grid with all rights.
  • Go to the Catalog > Product. Add or edit product.
  • Keep sku name "demo-test/1234" or demo-test&1234 Save product.
  • Go to Postman.
  • Set Get Request with endpoint rest/V1/stockItems ex:- https://your-domain/index.php/rest/V1/stockItems/demo-test%2F1234
  • Set Oauth 1.0 Set Add authorization data to Request Headers.
  • Set Integration details in the OAuth request like consumer key, Access Token etc etc.
  • Send request

GitHub Issue link:- https://github.com/magento/magento2/issues/37830

  • random and probably useless question. DId you try to double url_encode the product sku ?
    – Marius
    Aug 2 at 10:07
  • @Marius, this issue is not random; it also occurs on the 2.4-develop instance. Magento does not have any validation on the SKU string, so it should work with '/' as well. Aug 2 at 12:14
  • @Marius, did you tried the given issue on your side? it's not useless it's making problem with third party service provider like and klaviyo or so more.. Aug 2 at 13:22
  • Sorry, I didn't have the time to try it. I just took a shot in the dark hoping it works.
    – Marius
    Aug 2 at 14:10
  • It's alright @Marius, Thanks for your time. Aug 2 at 16:09

1 Answer 1


Slace will stand for new page/action fro Magento API. So instead of using slace use some other variable like '-', '@' etc...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.