So I'm trying to make a SPA that uses Magento as its back office. To do this, I would like to use its REST API. And of course, it forces you to OAuth with Magento first. I have tried multiple ways to OAuth with it on the client, my own way which works fine with any of the popular OAuth1.0a services like Twitter and LinkedIn, I've also tried using this https://github.com/ddo/oauth-1.0a which also works with things that don't constantly break, cough magento cough. The issue I have is that I get back a 401 status saying signature invalid. This is the gist of it using the module:

var oauth = OAuth({
    consumer: {
        public: 'a604a470aaff57d6063800aef713a12a',
        secret: 'ecdbb5cb43c9299ab3372ad973792d47'
    signature_method: 'HMAC-SHA1'
var reqData = {
    url: '/oauth/initiate',
    method: 'POST',
    data: {
        oauth_callback: ''
var authData = oauth.authorize(reqData);
    url: reqData.url,
    type: reqData.method,
    data: authData,
    success: function(data){

So if I were to reconfigure this for any other OAuth1.0a service, it works fine. Wh would it be that magento does not? Additionally, I have gone through all the Admin configuration for Authing with REST

  • Did you try the OAuth authentication like in these examples here? devdocs.magento.com/guides/m1x/api/rest/authentication/… Wonder if this works then (even if it's not the way you want to use it). Commented Nov 4, 2015 at 18:49
  • See that'd be good and all, if I was trying to do it server side. Commented Nov 4, 2015 at 18:54
  • Yeah, I know. Just wondering if this is a general problem or just the way you're trying to authenticate. Commented Nov 4, 2015 at 18:56
  • And as far as the steps taken to authenticate, yes that is exactly what I am doing, but in Javascript. Commented Nov 4, 2015 at 18:57
  • Well it's definitely magento specific considering this way of auth'ing works pretty much anywhere else. Commented Nov 4, 2015 at 19:02

2 Answers 2


It is always recommended to use SSL, even along with OAuth, otherwise sensitive data can be intercepted by someone (in your case customer or order details). OAuth 1.0a at most can guarantee that data was not modified by man-in-the-middle, but has no data encryption mechanisms and thus leaves the payload readable by anyone.

At the same time, when SSL is enabled, there is no benefits in using signatures. So in your case it should be absolutely acceptable to use PLAINTEXT signature method with enabled SSL (in your example you use https, so you seem to have it already enabled). This will even work a little bit faster since there is no need to calculate and verify signature on each request.


So the issue turned out to be that HMAC-SHA1 in Crypto.js and HMAC-SHA1 in Magento do not work together. So unfortunately, the solution is use PLAINTEXT as the signature method.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.