I am calling a REST Api https://www.gliffy.com/products/online/api/apidocs/rest/#oauth which needs oAuthkey and Password. Here is my Class

public with sharing class DetailButtonController
  public string responseText {get;set;}

  public DetailButtonController() {
     responseText = '';

   public void doSomething() {

    String oauthkey='asdasdasd asd77cf6ef73b77';
    String oauthsecret='asdasdasdasd2195385b9aa2';
    String action='get';

    Http m_http = new Http();
    HttpRequest req = new HttpRequest();

    String content = 'action='+EncodingUtil.urlEncode(action, 'UTF-8')+'&oauth_consumer_key='+EncodingUtil.urlEncode(oauthkey, 'UTF-8')+'&oauth_consumer_secret='+EncodingUtil.urlEncode('oauthsecret', 'UTF-8');


    httpResponse response = m_http.send(req);

    responseText = response.getBody();


Apex Code

<apex:page controller="DetailButtonController">
    <b>Hello World!</b>
    <apex:form >
        <apex:commandButton value="Do something" action="{!doSomething}"/>
        <apex:outputPanel layout="block">

The error i am getting is as below, Does that mean there is some other method to call Rest API using OAuth?

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
  <response success="false" xmlns="http://www.abc.com">
   <error http-status="401">oauth consumer key and/or signature not included in request parameters or authorization header</error>

The API documentation says POST requests may include parameters in the body (as what would happen with a form submission from a browser via a post) while DELETE and GET methods MUST include parameters as part of the query string.
ALL requests must specify the OAuth Signature method (oauth_signature_method). Currently, the API ONLY supports signing using the HMAC-SHA1 signature method. Thus, use "HMAC-SHA1", as the value of the parameter and make sure to sign your requests using the HMAC-SHA1 signature algorithm.

  • Looks like you are missing "Authorization header" in your api call. You will have to go through the API documentation of the vendor, as everybody has their own implementation for generating this. – Salesforcesmarty Dec 28 '15 at 23:39
  • @Salesforcesmarty The documentation says "ALL requests must specify the OAuth Signature method (oauth_signature_method). Currently, the API ONLY supports signing using the HMAC-SHA1 signature method" not sure what that is – user580950 Dec 29 '15 at 1:03
  • This is probably too complex to solve here unless you can post all of the documentation. You're not providing the parameter oauth_signature_method, but you are providing some others - namely action, consumer key & consumer secret. It sounds like you're going to need to create your payload with all of the params, sign it with HMAC-SHA1 and then make the request. I would look for a Java request example from this API vendor that you can mimic in Salesforce. Here is an example of how this signing is performed with the Twitter API: dev.twitter.com/oauth/overview/creating-signatures – Mark Pond Dec 29 '15 at 2:10
  • @MarkPond I update the question with REST API url – user580950 Dec 29 '15 at 12:08

By looking at "ALL requests must specify the OAuth Signature method (oauth_signature_method). Currently, the API ONLY supports signing using the HMAC-SHA1 signature method" my guess is you need to encript your request with HMAC-SHA1 algorithm and then send it to your endpoint.

There is already library available at https://code.google.com/p/crypto-js/

<script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/hmac-sha1.js"></script>
    var hash = CryptoJS.HmacSHA1("Message", "Secret Passphrase");

If you could share the endpoint details then we should be able to provide more insights.


your request should look like:


    Authorization: OAuth realm="http://provider.example.net/",

For more details refer "http://oauth.googlecode.com/svn/spec/ext/consumer_request/1.0/drafts/1/spec.html#anchor8

Here is how you generate the oauth_nonce:

The oauth_nonce parameter is a unique token salesforce should generate for each unique request. https://www.gliffy.com will use this value to determine whether a request has been submitted multiple times. The value for this request was generated by base64 encoding 32 bytes of random data, and stripping out all non-word characters, but any approach which produces a relatively random alphanumeric string should be OK here.

- Generate a random alphanumeric string (like aAbBcC123 but longer) with 32 characters
- note that there are no special characters in your random string
- Convert the string to UTF8 data
- Base64 encode the UTF8 data

| improve this answer | |
  • here is the api that i am trying to conneect to gliffy.com/products/online/api/apidocs/rest/#oauth – user580950 Dec 29 '15 at 12:07
  • see my updated answer. my guess was right. Try it and let me know the response. – AtulRajguru9 Dec 29 '15 at 12:17
  • thanks for that one more question I have is, how to generate 1] oauth_nonce 2] oauth_signature in Apex, salesforce? – user580950 Dec 29 '15 at 14:33
  • see my updated answer – AtulRajguru9 Dec 30 '15 at 4:03
  • Thanks, Atul one more question: 1. Generate oauth_signature,oauth_nonce & oauth_timestamp is done. 2. When I sent a token request by passing those parameters I am getting an error because of SSL. i.e. Creating an OAuth Token should only be done using SSL It's because of SSL certificate. I have created a self-signed certificate in salesforce, I have to install it on Gliffy server? I am unable to find out a solution on this, please help – user580950 Dec 30 '15 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.