Account Options

  1. Sign in
The old Google Groups will be going away soon, but your browser is incompatible with the new version.
Google Groups Home
« Groups Home
Message from discussion oauth status update returning error 401 invalid / used nonce

Received: by 10.150.47.32 with SMTP id u32mr3529241ybu.11.1276717995736;
        Wed, 16 Jun 2010 12:53:15 -0700 (PDT)
X-BeenThere: twitter-development-talk@googlegroups.com
Received: by 10.151.33.42 with SMTP id l42ls394326ybj.1.p; Wed, 16 Jun 2010 
	12:53:04 -0700 (PDT)
Received: by 10.150.252.11 with SMTP id z11mr3545891ybh.3.1276717983970;
        Wed, 16 Jun 2010 12:53:03 -0700 (PDT)
Received: by 10.150.252.11 with SMTP id z11mr3545887ybh.3.1276717983914;
        Wed, 16 Jun 2010 12:53:03 -0700 (PDT)
Return-Path: <taylorsinglet...@twitter.com>
Received: from mail-gw0-f45.google.com (mail-gw0-f45.google.com [74.125.83.45])
        by gmr-mx.google.com with ESMTP id 19si390875ywh.8.2010.06.16.12.53.03;
        Wed, 16 Jun 2010 12:53:03 -0700 (PDT)
Received-SPF: pass (google.com: domain of taylorsinglet...@twitter.com designates 74.125.83.45 as permitted sender) client-ip=74.125.83.45;
Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of taylorsinglet...@twitter.com designates 74.125.83.45 as permitted sender) smtp.mail=taylorsinglet...@twitter.com
Received: by gwaa20 with SMTP id a20so2419999gwa.18
        for <twitter-development-talk@googlegroups.com>; Wed, 16 Jun 2010 12:53:03 -0700 (PDT)
Received: by 10.224.88.234 with SMTP id b42mr4719318qam.276.1276717982892; 
	Wed, 16 Jun 2010 12:53:02 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.224.19.130 with HTTP; Wed, 16 Jun 2010 12:52:42 -0700 (PDT)
In-Reply-To: <ccb51ce1-1edf-423b-9611-dcd7355da56e@k39g2000yqb.googlegroups.com>
References: <d3e6c422-29ce-4d54-862f-9407671d4c87@c10g2000yqi.googlegroups.com> 
	<-5348290580678020998@unknownmsgid> <202d09e1-93bc-4ffe-b0a1-3b5bdee101b0@y4g2000yqy.googlegroups.com> 
	<24b8f9b1-54ef-4280-ac71-269a2d446c54@k39g2000yqb.googlegroups.com> 
	<97827ba6-2fe7-478a-84d7-cbbf7b60c955@z8g2000yqz.googlegroups.com> 
	<14071413-547a-42de-a1a1-7312f3b6667f@q12g2000yqj.googlegroups.com> 
	<AANLkTimO2R_xFzWhPcRL8dDK9P7JppRy-5Yysi5ABL80@mail.gmail.com> 
	<ae8613a5-1cae-4731-b5db-0770e86f591d@y4g2000yqy.googlegroups.com> 
	<ccb51ce1-1edf-423b-9611-dcd7355da...@k39g2000yqb.googlegroups.com>
From: Taylor Singletary <taylorsinglet...@twitter.com>
Date: Wed, 16 Jun 2010 12:52:42 -0700
Message-ID: <AANLkTinFjCuUVe_MEFpLyrS1lUddd5prC3tNMjQIN...@mail.gmail.com>
Subject: Re: [twitter-dev] Re: oauth status update returning error 401 invalid 
	/ used nonce
To: twitter-development-talk@googlegroups.com
Content-Type: multipart/alternative; boundary=00c09f905ff3da547a04892b112e

--00c09f905ff3da547a04892b112e
Content-Type: text/plain; charset=UTF-8

Our setup is such that I can't easily trace a single request.

Connecting some dots: if you have time, can you try to use a different
access token with your keys and see if it has the ability to tweet?

Can you go to your application settings and verify that your application is
in "read/write mode" on dev.twitter.com?

Finally, this might be a case of something funky with your client
application -- which might be resolved by creating a new one. But let's rule
out some other possibilities first.

Taylor Singletary
Developer Advocate, Twitter
http://twitter.com/episod


On Wed, Jun 16, 2010 at 12:39 PM, Craig <chanson9...@gmail.com> wrote:

> By the way, even when I try to tweet with just one word like: "tweet",
> it doesn't work.  Just simple ascii characters.  Is there any way you
> can just intercept one of my test tweets and look at what, if anything
> might be going wrong on the server side?
>
> -Craig
>
>
> On Jun 16, 3:05 pm, Craig <chanson9...@gmail.com> wrote:
> > My signature base string status pair looks like:
> > status%3Dmy%2520tweet
> >
> > When I tried xAuth authentication with a * character in the password,
> > it didn't work at first.  But once I double url encoded it, I was able
> > to authenticate no problem.  So that definitely helps.  I am now
> > double url encoding the username and password values.
> >
> > However, the tweet still didn't work.  I am double url encoding the
> > status message in the signature base string and single url encoding it
> > in the post body.
> >
> > Thanks,
> > Craig
> >
> > On Jun 16, 11:30 am, Taylor Singletary <taylorsinglet...@twitter.com>
> > wrote:
> >
> >
> >
> > > Hi Craig,
> >
> > > Do you know if the status update, status=my%20tweet is being encoded
> > > correctly in your signature base string (which is the string used to
> create
> > > your signature).
> >
> > > For the signature base string, the key/value pair would look like:
> >
> > > status%3Dmy%2520tweet
> >
> > > Have you tried your xAuth authentication with spaces and other possible
> odd
> > > characters yet in fields like the password?
> >
> > > Taylor
> >
> > > On Wed, Jun 16, 2010 at 8:21 AM, Craig <chanson9...@gmail.com> wrote:
> > > > Hi Matt,
> >
> > > > Thanks for responding.  My authorization header is still the same as
> > > > it was in my first message above.  Here it is for another request I
> > > > just tried:
> >
> > > > OAuth oauth_nonce="TEeSMm8q3m5abhmppain",
> oauth_signature_method="HMAC-
> > > > SHA1", oauth_timestamp="1276701304",
> > > > oauth_consumer_key="xxxxxxxxxxxxxxxxx", oauth_token="xxxxxxxx-
> > > > xxxxxxxxxxxxxxxxxxxxxxxxx", oauth_signature="xxxxxxxxxxxxxxxxxxxxxxx
> > > > %3D", oauth_version="1.0"
> >
> > > > The post body is simply:
> > > > status=my%20tweet
> >
> > > > When I create the request in objective c, it looks like this: (where
> > > > authHeader is the authorization header noted above and postBody is
> the
> > > > post body noted above):
> >
> > > > NSString* requestString= [NSString
> > > > stringWithFormat:@"%@",TWITTER_STATUS_UPDATE_URL];
> > > > NSMutableURLRequest* request = [[NSMutableURLRequest alloc]
> > > >                                initWithURL:[NSURL
> > > > URLWithString:requestString]
> >
> > > > cachePolicy:NSURLRequestReloadIgnoringCacheData
> > > >                                    timeoutInterval:30.0];
> > > > [request setHTTPMethod:@"POST"];
> > > > [request addValue:authHeader forHTTPHeaderField:@"Authorization"];
> > > > [request setValue:@"application/x-www-form-urlencoded"
> > > > forHTTPHeaderField:@"Content-Type"];
> > > > [request setValue:postBodyLength forHTTPHeaderField:@"Content-
> > > > Length"];
> > > > [request setHTTPBody:[postBody
> > > > dataUsingEncoding:NSUTF8StringEncoding]];
> >
> > > > This type of formatting works just fine for my xAuth authentication.
> >
> > > > On Jun 15, 4:44 pm, themattharris <thematthar...@twitter.com> wrote:
> > > > > Hey Craig,
> >
> > > > > Could you let us see what the authorization header you are sending
> > > > > looks like (obfuscating your oauth keys and secrets)?
> >
> > > > > What you're aiming for is a header similar to this:
> >
> > > > > POST /1/statuses/update.xml HTTP/1.1
> > > > > Accept: */*
> > > > > Connection: close
> > > > > User-Agent: OAuth gem v0.4.0
> > > > > Content-Type: application/x-www-form-urlencoded
> > > > > Authorization: OAuth
> > > > >   oauth_consumer_key=\"xxxxxxxxxxxxxxxxxxxxxxxx\",
> > > > >   oauth_nonce=\"xxxxxxxxxxxxxxxxxxxxxxxxxxxx\",
> > > > >   oauth_signature=\"xxxxxxxxxxxxxxxxxxxxxxxx\",
> > > > >   oauth_signature_method=\"HMAC-SHA1\",
> > > > >   oauth_timestamp=\"1276634179\",
> > > > >   oauth_token=\"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\",
> > > > >   oauth_version=\"1.0\"
> > > > > Content-Length: 27
> > > > > Host: api.twitter.com
> >
> > > > > With your post body being the status you are sending. Similar to:
> >
> > > > > status=something%20to%20say
> >
> > > > > Matt
> >
> > > > > On Jun 13, 8:32 pm, Craig <chanson9...@gmail.com> wrote:
> >
> > > > > > Ok, so I believe my signature is correct because if I take out
> the
> > > > > > oauth_token parameter from the signature base I get an incorrect
> > > > > > signature error instead of the invalid/used nonce error.  I am
> > > > > > definitely posting to the correct url: "
> https://api.twitter.com/1/
> > > > > > statuses/update.xml" because if I change it I get an invalid url
> > > > > > response.  The nonce I'm generating is unique for every request
> I'm
> > > > > > sending.  The timestamp is accurate to the number of seconds that
> have
> > > > > > passed since unix epoch.  Obviously the invalid/used nonce error
> is
> > > > > > garbage.
> >
> > > > > > Here's the formatting of my URL request in obj c:
> >
> > > > > > // Create the request
> > > > > > NSString* requestString= [NSString
> > > > > > stringWithFormat:@"%@",TWITTER_STATUS_UPDATE_URL];
> > > > > > NSMutableURLRequest* request = [[NSMutableURLRequest alloc]
> > > > > >                                 initWithURL:[NSURL
> > > > URLWithString:requestString]
> >
> > > > cachePolicy:NSURLRequestReloadIgnoringCacheData
> > > > > >                                     timeoutInterval:30.0];
> > > > > > [request setHTTPMethod:@"POST"];
> > > > > > [request addValue:authHeader forHTTPHeaderField:@
> "Authorization"];
> > > > > > [request setValue:@"application/x-www-form-urlencoded"
> > > > > > forHTTPHeaderField:@"Content-Type"];
> > > > > > [request setValue:postBodyLength forHTTPHeaderField:@"Content-
> > > > > > Length"];
> > > > > > [request setHTTPBody:[postBody
> > > > > > dataUsingEncoding:NSUTF8StringEncoding]];
> >
> > > > > > Any other ideas?  I'm at a total loss as to why this might be
> > > > > > happening.
> >
> > > > > > Thanks,
> > > > > > Craig
> >
> > > > > > On Jun 13, 3:42 pm, Craig <chanson9...@gmail.com> wrote:
> >
> > > > > > > No dice.  I just tried creating a new app and using the new
> > > > keys/token
> > > > > > > to tweet.  I'll go over my steps once more and see if I can
> track
> > > > down
> > > > > > > an issue somewhere...
> >
> > > > > > > On Jun 11, 8:53 pm, Taylor Singletary <
> taylorsinglet...@twitter.com>
> > > > > > > wrote:
> >
> > > > > > > > xAuth in this case, I think, is unrelated to the issue. If
> you can
> > > > use
> > > > > > > > a different key and use the "my token" feature to get your
> access
> > > > > > > > token, then try to tweet using that token, it will
> sufficiently
> > > > > > > > express the problem I think.
> >
> > > > > > > > Taylor
> >
> > > > > > > > On Jun 11, 2010, at 2:48 PM, Craig <chanson9...@gmail.com>
> wrote:
> >
> > > > > > > > > Hello,
> >
> > > > > > > > > I have an iphone app that is using xauth.  I am able to
> obtain
> > > > the
> > > > > > > > > access token with no problem at all.  When I go to post a
> status
> > > > > > > > > update, I receive an invalid / used nonce error.  It can't
> > > > actually be
> > > > > > > > > a used nonce since I have checked this multiple times.
>  Here are
> > > > the
> > > > > > > > > details of the post:
> >
> > > > > > > > > url:
> > > > > > > > >http://api.twitter.com/1/statuses/update.xml
> >
> > > > > > > > > signature base string:
> > > > > > > > > POST&http%3A%2F%2Fapi.twitter.com%2F1%2Fstatuses
> > > > > > > > >
> %2Fupdate.xml&oauth_consumer_key%3Dmyconsumerkey%26oauth_nonce
> > > > > > > > > %3D397vi5Ug1YHC3UAVUAoB%26oauth_signature_method%3DHMAC-
> > > > > > > > > SHA1%26oauth_timestamp%3D1276292596%26oauth_token%3Dmytoken
> > > > > > > > > %26oauth_version%3D1.0%26status%3Dmy%2520tweet
> >
> > > > > > > > > Authorization header:
> > > > > > > > > OAuth oauth_nonce="397vi5Ug1YHC3UAVUAoB",
> > > > oauth_signature_method="HMAC-
> > > > > > > > > SHA1", oauth_timestamp="1276292596",
> > > > > > > > > oauth_consumer_key="myconsumerkey", oauth_token="mytoken",
> > > > > > > > > oauth_signature="yOh2zQPGDBlVEP5cDWhjddQWTLc%3D",
> > > > oauth_version="1.0"
> >
> > > > > > > > > Content-Type:
> > > > > > > > > [request setValue:@"application/x-www-form-urlencoded"
> > > > > > > > > forHTTPHeaderField:@"Content-Type"];
> >
> > > > > > > > > I can see no reason why this shouldn't work.  Any help
> would be
> > > > > > > > > greatly appreciated!
> >
> > > > > > > > > Thanks,
> > > > > > > > > Craig
>

--00c09f905ff3da547a04892b112e
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Our setup is such that I can&#39;t easily trace a single request.<div><br><=
/div><div>Connecting some dots: if you have time, can you try to use a diff=
erent access token with your keys and see if it has the ability to tweet?</=
div>

<div><br></div><div>Can you go to your application settings and verify that=
 your application is in &quot;read/write mode&quot; on <a href=3D"http://de=
v.twitter.com">dev.twitter.com</a>?</div><div><br></div><div>Finally, this =
might be a case of something funky with your client application -- which mi=
ght be resolved by creating a new one. But let&#39;s rule out some other po=
ssibilities first.</div>

<div><br></div><div>Taylor Singletary<br>Developer Advocate, Twitter<br><a =
href=3D"http://twitter.com/episod">http://twitter.com/episod</a><br>
<br><br><div class=3D"gmail_quote">On Wed, Jun 16, 2010 at 12:39 PM, Craig =
<span dir=3D"ltr">&lt;<a href=3D"mailto:chanson9...@gmail.com">chanson9000@=
gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

By the way, even when I try to tweet with just one word like: &quot;tweet&q=
uot;,<br>
it doesn&#39;t work. =C2=A0Just simple ascii characters. =C2=A0Is there any=
 way you<br>
can just intercept one of my test tweets and look at what, if anything<br>
might be going wrong on the server side?<br>
<font color=3D"#888888"><br>
-Craig<br>
</font><div><div></div><div class=3D"h5"><br>
<br>
On Jun 16, 3:05=C2=A0pm, Craig &lt;<a href=3D"mailto:chanson9...@gmail.com"=
>chanson9...@gmail.com</a>&gt; wrote:<br>
&gt; My signature base string status pair looks like:<br>
&gt; status%3Dmy%2520tweet<br>
&gt;<br>
&gt; When I tried xAuth authentication with a * character in the password,<=
br>
&gt; it didn&#39;t work at first. =C2=A0But once I double url encoded it, I=
 was able<br>
&gt; to authenticate no problem. =C2=A0So that definitely helps. =C2=A0I am=
 now<br>
&gt; double url encoding the username and password values.<br>
&gt;<br>
&gt; However, the tweet still didn&#39;t work. =C2=A0I am double url encodi=
ng the<br>
&gt; status message in the signature base string and single url encoding it=
<br>
&gt; in the post body.<br>
&gt;<br>
&gt; Thanks,<br>
&gt; Craig<br>
&gt;<br>
&gt; On Jun 16, 11:30=C2=A0am, Taylor Singletary &lt;<a href=3D"mailto:tayl=
orsinglet...@twitter.com">taylorsinglet...@twitter.com</a>&gt;<br>
&gt; wrote:<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; &gt; Hi Craig,<br>
&gt;<br>
&gt; &gt; Do you know if the status update, status=3Dmy%20tweet is being en=
coded<br>
&gt; &gt; correctly in your signature base string (which is the string used=
 to create<br>
&gt; &gt; your signature).<br>
&gt;<br>
&gt; &gt; For the signature base string, the key/value pair would look like=
:<br>
&gt;<br>
&gt; &gt; status%3Dmy%2520tweet<br>
&gt;<br>
&gt; &gt; Have you tried your xAuth authentication with spaces and other po=
ssible odd<br>
&gt; &gt; characters yet in fields like the password?<br>
&gt;<br>
&gt; &gt; Taylor<br>
&gt;<br>
&gt; &gt; On Wed, Jun 16, 2010 at 8:21 AM, Craig &lt;<a href=3D"mailto:chan=
son9...@gmail.com">chanson9...@gmail.com</a>&gt; wrote:<br>
&gt; &gt; &gt; Hi Matt,<br>
&gt;<br>
&gt; &gt; &gt; Thanks for responding. =C2=A0My authorization header is stil=
l the same as<br>
&gt; &gt; &gt; it was in my first message above. =C2=A0Here it is for anoth=
er request I<br>
&gt; &gt; &gt; just tried:<br>
&gt;<br>
&gt; &gt; &gt; OAuth oauth_nonce=3D&quot;TEeSMm8q3m5abhmppain&quot;, oauth_=
signature_method=3D&quot;HMAC-<br>
&gt; &gt; &gt; SHA1&quot;, oauth_timestamp=3D&quot;1276701304&quot;,<br>
&gt; &gt; &gt; oauth_consumer_key=3D&quot;xxxxxxxxxxxxxxxxx&quot;, oauth_to=
ken=3D&quot;xxxxxxxx-<br>
&gt; &gt; &gt; xxxxxxxxxxxxxxxxxxxxxxxxx&quot;, oauth_signature=3D&quot;xxx=
xxxxxxxxxxxxxxxxxxxx<br>
&gt; &gt; &gt; %3D&quot;, oauth_version=3D&quot;1.0&quot;<br>
&gt;<br>
&gt; &gt; &gt; The post body is simply:<br>
&gt; &gt; &gt; status=3Dmy%20tweet<br>
&gt;<br>
&gt; &gt; &gt; When I create the request in objective c, it looks like this=
: (where<br>
&gt; &gt; &gt; authHeader is the authorization header noted above and postB=
ody is the<br>
&gt; &gt; &gt; post body noted above):<br>
&gt;<br>
&gt; &gt; &gt; NSString* requestString=3D [NSString<br>
&gt; &gt; &gt; stringWithFormat:@&quot;%@&quot;,TWITTER_STATUS_UPDATE_URL];=
<br>
&gt; &gt; &gt; NSMutableURLRequest* request =3D [[NSMutableURLRequest alloc=
]<br>
&gt; &gt; &gt; =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0initWithURL:[NSURL<br>
&gt; &gt; &gt; URLWithString:requestString]<br>
&gt;<br>
&gt; &gt; &gt; cachePolicy:NSURLRequestReloadIgnoringCacheData<br>
&gt; &gt; &gt; =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0timeoutIn=
terval:30.0];<br>
&gt; &gt; &gt; [request setHTTPMethod:@&quot;POST&quot;];<br>
&gt; &gt; &gt; [request addValue:authHeader forHTTPHeaderField:@&quot;Autho=
rization&quot;];<br>
&gt; &gt; &gt; [request setValue:@&quot;application/x-www-form-urlencoded&q=
uot;<br>
&gt; &gt; &gt; forHTTPHeaderField:@&quot;Content-Type&quot;];<br>
&gt; &gt; &gt; [request setValue:postBodyLength forHTTPHeaderField:@&quot;C=
ontent-<br>
&gt; &gt; &gt; Length&quot;];<br>
&gt; &gt; &gt; [request setHTTPBody:[postBody<br>
&gt; &gt; &gt; dataUsingEncoding:NSUTF8StringEncoding]];<br>
&gt;<br>
&gt; &gt; &gt; This type of formatting works just fine for my xAuth authent=
ication.<br>
&gt;<br>
&gt; &gt; &gt; On Jun 15, 4:44 pm, themattharris &lt;<a href=3D"mailto:them=
atthar...@twitter.com">thematthar...@twitter.com</a>&gt; wrote:<br>
&gt; &gt; &gt; &gt; Hey Craig,<br>
&gt;<br>
&gt; &gt; &gt; &gt; Could you let us see what the authorization header you =
are sending<br>
&gt; &gt; &gt; &gt; looks like (obfuscating your oauth keys and secrets)?<b=
r>
&gt;<br>
&gt; &gt; &gt; &gt; What you&#39;re aiming for is a header similar to this:=
<br>
&gt;<br>
&gt; &gt; &gt; &gt; POST /1/statuses/update.xml HTTP/1.1<br>
&gt; &gt; &gt; &gt; Accept: */*<br>
&gt; &gt; &gt; &gt; Connection: close<br>
&gt; &gt; &gt; &gt; User-Agent: OAuth gem v0.4.0<br>
&gt; &gt; &gt; &gt; Content-Type: application/x-www-form-urlencoded<br>
&gt; &gt; &gt; &gt; Authorization: OAuth<br>
&gt; &gt; &gt; &gt; =C2=A0 oauth_consumer_key=3D\&quot;xxxxxxxxxxxxxxxxxxxx=
xxxx\&quot;,<br>
&gt; &gt; &gt; &gt; =C2=A0 oauth_nonce=3D\&quot;xxxxxxxxxxxxxxxxxxxxxxxxxxx=
x\&quot;,<br>
&gt; &gt; &gt; &gt; =C2=A0 oauth_signature=3D\&quot;xxxxxxxxxxxxxxxxxxxxxxx=
x\&quot;,<br>
&gt; &gt; &gt; &gt; =C2=A0 oauth_signature_method=3D\&quot;HMAC-SHA1\&quot;=
,<br>
&gt; &gt; &gt; &gt; =C2=A0 oauth_timestamp=3D\&quot;1276634179\&quot;,<br>
&gt; &gt; &gt; &gt; =C2=A0 oauth_token=3D\&quot;xxxxxxxxxxxxxxxxxxxxxxxxxxx=
xxx\&quot;,<br>
&gt; &gt; &gt; &gt; =C2=A0 oauth_version=3D\&quot;1.0\&quot;<br>
&gt; &gt; &gt; &gt; Content-Length: 27<br>
&gt; &gt; &gt; &gt; Host: <a href=3D"http://api.twitter.com" target=3D"_bla=
nk">api.twitter.com</a><br>
&gt;<br>
&gt; &gt; &gt; &gt; With your post body being the status you are sending. S=
imilar to:<br>
&gt;<br>
&gt; &gt; &gt; &gt; status=3Dsomething%20to%20say<br>
&gt;<br>
&gt; &gt; &gt; &gt; Matt<br>
&gt;<br>
&gt; &gt; &gt; &gt; On Jun 13, 8:32 pm, Craig &lt;<a href=3D"mailto:chanson=
9...@gmail.com">chanson9...@gmail.com</a>&gt; wrote:<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; Ok, so I believe my signature is correct because i=
f I take out the<br>
&gt; &gt; &gt; &gt; &gt; oauth_token parameter from the signature base I ge=
t an incorrect<br>
&gt; &gt; &gt; &gt; &gt; signature error instead of the invalid/used nonce =
error. =C2=A0I am<br>
&gt; &gt; &gt; &gt; &gt; definitely posting to the correct url: &quot;<a hr=
ef=3D"https://api.twitter.com/1/" target=3D"_blank">https://api.twitter.com=
/1/</a><br>
&gt; &gt; &gt; &gt; &gt; statuses/update.xml&quot; because if I change it I=
 get an invalid url<br>
&gt; &gt; &gt; &gt; &gt; response. =C2=A0The nonce I&#39;m generating is un=
ique for every request I&#39;m<br>
&gt; &gt; &gt; &gt; &gt; sending. =C2=A0The timestamp is accurate to the nu=
mber of seconds that have<br>
&gt; &gt; &gt; &gt; &gt; passed since unix epoch. =C2=A0Obviously the inval=
id/used nonce error is<br>
&gt; &gt; &gt; &gt; &gt; garbage.<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; Here&#39;s the formatting of my URL request in obj=
 c:<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; // Create the request<br>
&gt; &gt; &gt; &gt; &gt; NSString* requestString=3D [NSString<br>
&gt; &gt; &gt; &gt; &gt; stringWithFormat:@&quot;%@&quot;,TWITTER_STATUS_UP=
DATE_URL];<br>
&gt; &gt; &gt; &gt; &gt; NSMutableURLRequest* request =3D [[NSMutableURLReq=
uest alloc]<br>
&gt; &gt; &gt; &gt; &gt; =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 initWithURL:=
[NSURL<br>
&gt; &gt; &gt; URLWithString:requestString]<br>
&gt;<br>
&gt; &gt; &gt; cachePolicy:NSURLRequestReloadIgnoringCacheData<br>
&gt; &gt; &gt; &gt; &gt; =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 timeoutInterval:30.0];<br>
&gt; &gt; &gt; &gt; &gt; [request setHTTPMethod:@&quot;POST&quot;];<br>
&gt; &gt; &gt; &gt; &gt; [request addValue:authHeader forHTTPHeaderField:@&=
quot;Authorization&quot;];<br>
&gt; &gt; &gt; &gt; &gt; [request setValue:@&quot;application/x-www-form-ur=
lencoded&quot;<br>
&gt; &gt; &gt; &gt; &gt; forHTTPHeaderField:@&quot;Content-Type&quot;];<br>
&gt; &gt; &gt; &gt; &gt; [request setValue:postBodyLength forHTTPHeaderFiel=
d:@&quot;Content-<br>
&gt; &gt; &gt; &gt; &gt; Length&quot;];<br>
&gt; &gt; &gt; &gt; &gt; [request setHTTPBody:[postBody<br>
&gt; &gt; &gt; &gt; &gt; dataUsingEncoding:NSUTF8StringEncoding]];<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; Any other ideas? =C2=A0I&#39;m at a total loss as =
to why this might be<br>
&gt; &gt; &gt; &gt; &gt; happening.<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; Thanks,<br>
&gt; &gt; &gt; &gt; &gt; Craig<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; On Jun 13, 3:42 pm, Craig &lt;<a href=3D"mailto:ch=
anson9...@gmail.com">chanson9...@gmail.com</a>&gt; wrote:<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; No dice. =C2=A0I just tried creating a new ap=
p and using the new<br>
&gt; &gt; &gt; keys/token<br>
&gt; &gt; &gt; &gt; &gt; &gt; to tweet. =C2=A0I&#39;ll go over my steps onc=
e more and see if I can track<br>
&gt; &gt; &gt; down<br>
&gt; &gt; &gt; &gt; &gt; &gt; an issue somewhere...<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; On Jun 11, 8:53 pm, Taylor Singletary &lt;<a =
href=3D"mailto:taylorsinglet...@twitter.com">taylorsinglet...@twitter.com</=
a>&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; wrote:<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; xAuth in this case, I think, is unrelate=
d to the issue. If you can<br>
&gt; &gt; &gt; use<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; a different key and use the &quot;my tok=
en&quot; feature to get your access<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; token, then try to tweet using that toke=
n, it will sufficiently<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; express the problem I think.<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; Taylor<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; On Jun 11, 2010, at 2:48 PM, Craig &lt;<=
a href=3D"mailto:chanson9...@gmail.com">chanson9...@gmail.com</a>&gt; wrote=
:<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; Hello,<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; I have an iphone app that is using =
xauth. =C2=A0I am able to obtain<br>
&gt; &gt; &gt; the<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; access token with no problem at all=
. =C2=A0When I go to post a status<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; update, I receive an invalid / used=
 nonce error. =C2=A0It can&#39;t<br>
&gt; &gt; &gt; actually be<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; a used nonce since I have checked t=
his multiple times. =C2=A0Here are<br>
&gt; &gt; &gt; the<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; details of the post:<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; url:<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt;<a href=3D"http://api.twitter.com/1/=
statuses/update.xml" target=3D"_blank">http://api.twitter.com/1/statuses/up=
date.xml</a><br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; signature base string:<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; POST&amp;http%3A%2F%<a href=3D"http=
://2Fapi.twitter.com" target=3D"_blank">2Fapi.twitter.com</a>%2F1%2Fstatuse=
s<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; %2Fupdate.xml&amp;oauth_consumer_ke=
y%3Dmyconsumerkey%26oauth_nonce<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; %3D397vi5Ug1YHC3UAVUAoB%26oauth_sig=
nature_method%3DHMAC-<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; SHA1%26oauth_timestamp%3D1276292596=
%26oauth_token%3Dmytoken<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; %26oauth_version%3D1.0%26status%3Dm=
y%2520tweet<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; Authorization header:<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; OAuth oauth_nonce=3D&quot;397vi5Ug1=
YHC3UAVUAoB&quot;,<br>
&gt; &gt; &gt; oauth_signature_method=3D&quot;HMAC-<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; SHA1&quot;, oauth_timestamp=3D&quot=
;1276292596&quot;,<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; oauth_consumer_key=3D&quot;myconsum=
erkey&quot;, oauth_token=3D&quot;mytoken&quot;,<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; oauth_signature=3D&quot;yOh2zQPGDBl=
VEP5cDWhjddQWTLc%3D&quot;,<br>
&gt; &gt; &gt; oauth_version=3D&quot;1.0&quot;<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; Content-Type:<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; [request setValue:@&quot;applicatio=
n/x-www-form-urlencoded&quot;<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; forHTTPHeaderField:@&quot;Content-T=
ype&quot;];<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; I can see no reason why this should=
n&#39;t work. =C2=A0Any help would be<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; greatly appreciated!<br>
&gt;<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; Thanks,<br>
&gt; &gt; &gt; &gt; &gt; &gt; &gt; &gt; Craig<br>
</div></div></blockquote></div><br></div>

--00c09f905ff3da547a04892b112e--