You'll need to determine if the server is expecting the POST body to be included in the signature; typically, it is not, unless the Content-Type is application/x-www-form-urlencoded.
Set breakpoints in -signatureForParams:request: and +addBodyFromRequest:toParams: to see what is happening during the signature calculation.