How to get request_token using OAuth with twitter

Question

I am using the following method URI to request token from twitter.

Note: here new lines are just for display purpose only.

http://twitter.com/oauth/request_token?
oauth_consumer_key=9cS99b2406CUpATOeggeA&
oauth_signature_method=HMAC-SHA1&
oauth_signature=3e18bafc4c4fd6b23f988bcd1a8c0ab2d65db784
oauth_timestamp=1267523137&
oauth_nonce=56e66e9f8bd28b320f86a16407f9911d&
oauth_version=1.0&
oauth_callback=http://playground.com

But it gives error "Failed to validate oauth signature and token".

The base string I used to computer signature is as bellow:

GET&
http%3A%2F%2Ftwitter.com%2Foauth%2Frequest_token&
oauth_consumer_key%3D9cS99b2406CUpATOeggeA%26
oauth_signature_method%3DHMAC-SHA1%26
oauth_timestamp%3D1267523137%26
oauth_nonce%3D56e66e9f8bd28b320f86a16407f9911d%26
oauth_version%3D1.0%26
oauth_callback%3Dhttp%3A%2F%2Fplayground.com

Please correct me where am I making mistake.

Answer 1

Your problem is with the order of the parameters. The parameters for the base string need to be in order. If they are out of order, it will give you that error.

So your base string should be this...

GET&
http%3A%2F%2Ftwitter.com%2Foauth%2Frequest_token&
oauth_consumer_key%3D9cS99b2406CUpATOeggeA%26
oauth_nonce%3D56e66e9f8bd28b320f86a16407f9911d%26
oauth_signature_method%3DHMAC-SHA1%26
oauth_timestamp%3D1267523137%26
oauth_version%3D1.0%26
oauth_callback%3Dhttp%3A%2F%2Fplayground.com

Notice that your "nonce" was not in the correct spot.

Also, normally, the "signature" parameter is appended to the end of the request URL.

http://oauth.net/core/1.0a/#anchor46

Appendix A.5.1

Answer 2

What Eclipsed4utoo said - though if you're still getting the error you should check that you've registered your application as being browser based (and specified a callback) in the Twitter dev admin pages.

If it's listed as a desktop app but you include &oauth_callback in calls you'll see the signature validation error you mention.