Magento 2 REST API Endpoint /V1/stockItems/:productSku is encountering a bug specifically when using OAuth 1.0 authentication. The issue arises when the product SKU contains special characters such as slashes (/) or ampersands (&). This results in an incorrect OAuth signature being generated, leading to errors in the authentication process.

The error is being triggered from the class Magento\Framework\Oauth\Oauth::_validateSignature() at line number 207. The root cause of the problem lies in the signature generation process, which is performed by the Laminas library. The library generates different signatures for SKUs containing slashes or ampersands, causing inconsistencies in the authentication flow.

Example: Working URL: https://test.com/test-sku Not Working URL: https://test.com/test-sku%2F123

The correct OAuth signature generation for the product SKU is not taking into account the special characters, leading to an incorrect signature that fails the authentication process.

To fix this issue, adjustments need to be made in the OAuth signature generation logic, ensuring that it properly handles SKUs with special characters and produces consistent signatures for all SKU variations.

Please see below screenshot for more reference.

enter image description here

Steps to reproduce

  • Login to Magento admin. Navigate to System > Extensions > Integrations > Add New Integration.
  • Activate Added Integration from the Integration grid with all rights.
  • Go to the Catalog > Product. Add or edit product.
  • Keep sku name "demo-test/1234" or demo-test&1234 Save product.
  • Go to Postman.
  • Set Get Request with endpoint rest/V1/stockItems ex:- https://your-domain/index.php/rest/V1/stockItems/demo-test%2F1234
  • Set Oauth 1.0 Set Add authorization data to Request Headers.
  • Set Integration details in the OAuth request like consumer key, Access Token etc etc.
  • Send request

GitHub Issue link:- https://github.com/magento/magento2/issues/37830

  • random and probably useless question. DId you try to double url_encode the product sku ?
    – Marius
    Commented Aug 2, 2023 at 10:07
  • @Marius, this issue is not random; it also occurs on the 2.4-develop instance. Magento does not have any validation on the SKU string, so it should work with '/' as well. Commented Aug 2, 2023 at 12:14
  • @Marius, did you tried the given issue on your side? it's not useless it's making problem with third party service provider like and klaviyo or so more.. Commented Aug 2, 2023 at 13:22
  • Sorry, I didn't have the time to try it. I just took a shot in the dark hoping it works.
    – Marius
    Commented Aug 2, 2023 at 14:10
  • It's alright @Marius, Thanks for your time. Commented Aug 2, 2023 at 16:09

1 Answer 1


Slace will stand for new page/action fro Magento API. So instead of using slace use some other variable like '-', '@' etc...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.