I am facing an issue while generation Auth signature in salesforce. I tried to test the API from Postman and it works well with key and token. Even when I change the Authorization Header in Apex to the postman request header it works well but if I use the code to generate auth signature then Response is always Unauthorized access.

    String nonce = String.valueOf(Crypto.getRandomLong());
    String timestamp = string.valueof(dateTime.now().getTime()/1000);
    String companyId = '123145730762509';
    String APIURL = 'https://sandbox-quickbooks.api.intuit.com/v3/company/'+companyId+'/account/1';
    Map<String,String> parameters = new Map<String,String>();
    parameters.put('oauth_consumer_key', Consumer_Key);
    parameters.put('oauth_nonce', nonce);
    parameters.put('oauth_signature_method', 'HMAC-SHA1');
    parameters.put('oauth_timestamp', timestamp);
    parameters.put('oauth_version', '1.0');

    HttpRequest req = new HttpRequest();
    HttpResponse res;
    String signature = generateSignature(req, Consumer_Secret, '', parameters);

private static String generateSignature(HttpRequest req, String consumerSecret, String tokenSecret, Map<String,String> parameters) {
    String s    = createBaseString(parameters, req);         \
    Blob sig = Crypto.generateMac('HmacSHA1', Blob.valueOf(s), 
                            (tokenSecret!=null ? tokenSecret : '')));
    String signature = EncodingUtil.urlEncode(EncodingUtil.base64encode(sig), 'UTF-8');
    System.debug('Signature: '+signature);
    return signature;

private static String createBaseString(HttpRequest req, Map<String,String> parameters) {
    Map<String,String> p = parameters.clone();
    String host = req.getEndpoint();
    Integer n = host.indexOf('?');
    if(n>-1) {
        host = host.substring(0,n);
    List<String> keys = new List<String>();
    String s = keys.get(0)+'='+p.get(keys.get(0));
    for(Integer i=1;i<keys.size();i++) {
        s = s + '&' + keys.get(i)+'='+p.get(keys.get(i));

    return req.getMethod().toUpperCase()+ '&' +
        EncodingUtil.urlEncode(host, 'UTF-8') + '&' +
        EncodingUtil.urlEncode(s, 'UTF-8');

Base String :-

  • you might want to peruse my question here salesforce.stackexchange.com/questions/25341/… I had similar problems 2 years ago and it was stumping me for weeks until I finally solved it. – akarnid Nov 26 '16 at 18:41
  • Thanks @akarnid. I tried with the solution and done some changes but getting the same error. – Hitesh Gupta Nov 26 '16 at 19:33
  • Are you writing out the base string to system debug? Does the signature generated by generateSignature method match the signature in Postman exactly? – akarnid Nov 27 '16 at 11:22
  • Signature generated by generateSignature method does not match even I fixed the value of timestamp and nonce value to postman generated values. – Hitesh Gupta Nov 27 '16 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.