I am using the below in my wordpress for developing a oauth based application.

WP-API (api generating plugin)

WP API OAuth1 (oauth server)and

WP API client-cli (oauth client library)

at the below url is for the wp client-cli https://man-sudarshann-1.c9.io/api/

I am getting this error OAuth signature does not match when I click the AUTH button for autherizing the request. I have tried all the fixed for this over the internet. but none helped

signature generated and sent from api client is 3ko8DUsUUEB4Hqaks68vGYnTjQM=

signature generated in server side is 5rPsul6zplhfNvb4o+Mz11O/OyI=

so the below code is failing

if ( ! hash_equals( $signature, $consumer_signature ) ) {
    return new WP_Error( 'json_oauth1_signature_mismatch', __( 'OAuth signature does not match' ), array( 'status' => 401 ) );

I guess the API console is generating wrong signature. Please help me in solving this issue.

  • put single quotation marks around the values for $signature and $consumer_signature – user42826 Apr 27 '15 at 13:30
  • sorry I actually I just put them for reference not as code. these values are calculated but algorithms in javascript clients and server side – Sudarshan Anbazhagan Apr 27 '15 at 15:50

I was facing a similar issue when trying to use Client-CLI with OAuth 1.0a plugin, however I found a solution here on the official repository.

In the file lib/class-wp-json-authentication-oauth1.php on line 524, change the following code:

$base_request_uri = rawurlencode( get_home_url( null, parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH ), 'http' ) );


$home_url_path = parse_url(get_home_url (null,'','http'), PHP_URL_PATH );
$request_uri_path = parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH );
if (substr($request_uri_path, 0, strlen($home_url_path)) == $home_url_path) {
    $request_uri_path = substr($request_uri_path, strlen($home_url_path));
$base_request_uri = rawurlencode( get_home_url( null, $request_uri_path, 'http' ) );

This should solve the problem you are facing.

  • Would you mind expanding on how this works exactly? What changed? I don't know PHP but I'm running into the same issue with a javascript client I'm writing, and I think perhaps your solution might generalize to my app. – Chuck Dries Jun 24 '16 at 17:35

Make sure that signature request is handled correctly: http://oauth1.wp-api.org/docs/basics/Signing.html

If you're using POSTMAN you can set it to OAuth 1.0 under Authorization and then select the options

  • Add empty params to signature
  • Encode OAuth signature
  • Save helper data to request

Here's a detailed tutorial I wrote on using OAuth 1 and Postman with WordPress: https://wordpress.stackexchange.com/a/239873/51201

  • "Add empty params to signature" worked for me. I don't really understand the reason behind it. – Loc Pham Nov 1 '16 at 1:15
  • @LocPham it's because the signature is generated from the query arguments, thus, you need to have empty arguments included to have it generate the signature correctly – sMyles Nov 2 '16 at 4:11
  • I have problem in installing and activating plugins with wordpress 4.9.6. would you check this: wordpress.stackexchange.com/q/300120/141031 – Mahdi Apr 8 '18 at 5:04

In Postman under Authorization try deselecting "Add params to header".

  • not sure why this got downvoted, worked for me... – Splatbang Mar 23 '18 at 21:48
  • Worked here too! – Chris Nevill Sep 25 '19 at 16:28

check you baseurl forwarding. In my case the non-www was being forwarded to www. After updating the baseurl to www.example.com format it worked for me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.