OAuth 1.0 REST API — persistent auth failures after Consumer Secret reset

[Demetrios Wladios]

Hello,

I'm having a persistent issue with the OAuth 1.0 REST API credentials on my account.

Consumer Key: e9f225faecae42debb5c0384eabc4e20

Timeline:
- Aug 16, ~18:00 CEST — reset Consumer Secret via the dashboard. First attempt returned "An unexpected error occurred. Please try again." Retried immediately and it appeared to succeed.
- Since then, calls to food_entries.get (and other methods) fail inconsistently with two different errors, using the exact same Consumer Key/Secret pair shown in the dashboard:
  - {"error":{"code":5,"message":"Invalid consumer key: please check your oauth_consumer_key"}}
  - "Invalid signature: please refer to the documentation"
  Sometimes a handful of consecutive requests succeed, then fail again, with no change on my end between calls.
- Aug 17 — performed a second full reset of the Consumer Secret (this time with no UI error), waited 15+ minutes before retesting. Result unchanged: still fails consistently with "Invalid signature".

What I've already ruled out on my side:
- Consumer Key in my app matches exactly what's shown under "Show Consumer Key" in the dashboard.
- Consumer Secret was copied fresh from "Show Consumer Secret" both times, verified byte-for-byte clean (no whitespace/encoding issues).
- OAuth 1.0a HMAC-SHA1 signing implementation is standard and unchanged — it worked reliably for months before Aug 16.
- Server clock is synced within ~2 seconds of your server's Date header (ruled out timestamp skew).
- Ruled out local network/DNS issues (isolated and confirmed separately).

Note: the Access Token and Access Token Secret were not touched, since I didn't see a reset option for them on the API Keys page — only for Consumer Secret. Could you confirm whether these need to be reissued as well, or whether there's a step I'm missing after resetting the Consumer Secret?

Could you please check the backend state of the OAuth 1.0 credentials for this account? It looks like something didn't fully propagate/clear after the first failed reset attempt.

Thank you.

[seba...@fatsecret.com]

Thanks for reaching out.

It sounds like there is an isolated issues with your API key / ClientID.

We recommend for you to register for a new API account with an alternate email address and utilize this additional API key / ClientID instead.

Our team can assist further as required https://platform.fatsecret.com/contact