I'm having a hard time fetching orders from Magento REST API when I use its GET filters like http://localhost/magento/api/rest/orders/?filter[1][attribute]=entity_id&filter[1][gt]=70&page=1&limit=100

It is giving a "error":[{"code":401,"message":"oauth_problem=signature_invalid"}]

When I try hitting the same API endpoint using a REST Client like Postman, I'm getting back the desired results JSON.

I suspect the square brackets in the filter query might be causing a problem in generating a Oauth signature. All the endpoints without GET filters are working fine. I'm using the Request node module to make the GET request with the oauth headers.

Is there any fix to avoid the signature invalid error?

  • Is there any answer on this question or did you find a way to apply filter? i am also facing same problem
    – UmeshR
    Apr 26, 2015 at 9:05
  • The problem was within the Request node module I was using to generate a OAuth signature.It didn't factor for square brackets in the URL. I modified the code in the module for including square brackets. Check the OAuth signature generation method you are using.
    – srikanth
    Apr 27, 2015 at 17:03
  • that is right after some time spend i got it resolved, thank you for your pointers.
    – UmeshR
    Apr 30, 2015 at 6:46
  • I have the same problem. If the querystring contains square brackets the signature is invalid. How did you get to solve it? Thanks you.
    – user40053
    May 20, 2016 at 16:46
  • I am also having the same problem. How did you solved? The square brackets is encoding corretly and the querystring parameters order is ok but I still getting invalid signature. Jul 4, 2016 at 12:54

3 Answers 3


Did you managed to Encode the names and values of parameters?

I was having this issue too and this helped me.

You have to make sure that your signature base string parameters are in alphabetic order by parameter name

This is what i'm using to encode parameters in my signature base.

var result = new StringBuilder();
string webUnreservedChars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.~";
foreach (char symbol in url)
    if (webUnreservedChars.IndexOf(symbol) != -1)
        result.Append('%' + ((int)symbol).ToString("X2"));
return result.ToString();

Hope this helps :)

  • Welcome on Magento SE. Thanks for your answer. Although it is an answer to an old question, it may still be useful to others :) Nov 12, 2015 at 17:03

There is an issue with magento core functionality vendor/magento/framework/Oauth/Oauth.php Comment out line number 199.


The trick is you have to convert the square brackets in the signature base string twice:

  • [ => %5B => %255B
  • ] => %5D => %255D

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.