Sunday, 20 November 2022

Etrade API Oauth 1.0 flow fails with invalid oauth_signature

I would like to authenticate against the Etrade API using Go and Postman. I am following the official Etrade API Developer Docs:

Etrade API welcome page

I successfully completed the Oauth 1.0 flow using the Python example they provided (with some slight modifications to print some of the session attributes):

$ python3 etrade_python_client.py

1)  Sandbox Consumer Key
2)  Live Consumer Key
3)  Exit
Please select Consumer Key Type: 2

Please accept agreement and enter verification code from browser: REDACTED
access_token_response: <Response [200]>
access_token: REDACTED
access_token_secret: REDACTED

But I have had no success authenticating using the Go or Postman implementations of Oauth 1.0. For Go, I wrote this sample client using the dghubble/oauth1 library, and for Postman I am using the built-in auth tool.

My trouble is largely with generating the correct oauth_signature in each of these. I always get this error:

invalid signature

Or if I try to plug-and-play the access token I obtained from Etrade's sample Python client into Postman when, for instance, accessing the /accounts/list API endpoint, the response I receive is:

<Error>
  <message>oauth_problem=signature_invalid</message>
</Error>

It's strange that their Python example (which uses rauth) has a different behavior than Go or Postman. Seems that Etrade does something non-standard that fits the requests.Session shape of the rauth implementation. Is there a way to know if I'm generating my signatures correctly for any implementation I use?

Appendix:

Sample Postman requests:

postman: request_token postman: auth url postman: access_token

Capture of session attributes when using Python rauth library (sensitive info redacted): https://gist.github.com/natemurthy/a7f628e44da9651d0676291803915c9c



from Etrade API Oauth 1.0 flow fails with invalid oauth_signature

No comments:

Post a Comment