title: Tumblr API Photo Post Returns 401 (Not Authorized)
body: <p>I'm attempting to use the Tumblr API in an Android app to authorize users and make text and photo posts.  I'm using the Scribe library.  So for, I can successfully obtain an access token and use it to get user info.  I can also make text posts without any issues.  This tells me that I'm signing requests correctly.</p>
  
  <p>However, I've spent the last week and a half attempting to make photo posts without success.  I continuously receive 401 errors (Not Authorized)  I've read through many posts on the Tumblr support forum as well as here on Stack Overflow, but was unable to find a solution.</p>
  
  <p>I'm reluctant to include the Jumblr library because I'm trying to keep my app as lean as possible.  That said, I reviewed the Jumblr code and decided to mimic how photo posts are sent (<a href="https://github.com/tumblr/jumblr/blob/master/src/main/java/com/tumblr/jumblr/request/MultipartConverter.java" rel="nofollow">https://github.com/tumblr/jumblr/blob/master/src/main/java/com/tumblr/jumblr/request/MultipartConverter.java</a>).  I'm still receiving the exact same error.</p>
  
  <p>Below is an example my multipart POST request and the response I receive.  I've replace the blog name, and OAuth signature, consumer key, and token variables, and have removed the binary image data for brevity sake.  Everything else is untouched.  I have a few questions...</p>
  
  <ol>
  <li><p>Are there any other variables that should be included in the
  multipart section? A Stack Overflow user stated that placing the
  "oauth_" signature variables in there fixed his problem. I didn't
  have success with this, but maybe there was something I was missing.</p></li>
  <li><p>The Jumblr app doesn't appear to do any encoding of the image data,
  although the Tumblr documentation states that it should be URL
  encoded.  Right now I'm sending it as the Jumblr app appears to (raw
  binary).  Is this correct?</p></li>
  <li><p>Does anything else in my request look
  incorrect?</p></li>
  </ol>
  
  <p><strong>REQUEST:</strong></p>
  
  <p><em>NOTE: I learned that the OAuth signature  should be generated WITHOUT the multipart form.  My code takes that into account when building this request!</em></p>
  
  <pre><code>POST http://api.tumblr.com/v2/blog/**REMOVED**.tumblr.com/post HTTP/1.1
  Content-Type: multipart/form-data, boundary=cbe6b79db1b3cbe6b79e104e
  Authorization: OAuth oauth_signature="**REMOVED**", oauth_version="1.0", oauth_nonce="3181201716", oauth_signature_method="HMAC-SHA1", oauth_consumer_key="**REMOVED**", oauth_timestamp="1388791537", oauth_token="**REMOVED**"
  Content-Length: 1001
  User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.3; SM-N900T Build/JSS15J)
  Host: api.tumblr.com
  Connection: Keep-Alive
  Accept-Encoding: gzip
  
  --cbe6b79db1b3cbe6b79e104e
  Content-Disposition: form-data; name="type"
  
  photo
  --cbe6b79db1b3cbe6b79e104e
  Content-Disposition: form-data; name="caption"
  
  Another pic test...
  --cbe6b79db1b3cbe6b79e104e
  Content-Disposition: form-data; name="data[0]"; filename="postr_media_file_1388791537-1709648435.jpg"
  Content-Type: image/jpeg
  
  ---- BINARY DATA REMOVED FOR BREVITY ----
  </code></pre>
  
  <p><strong>RESPONSE:</strong></p>
  
  <pre><code>HTTP/1.1 401 Not Authorized
  Server: nginx
  Date: Fri, 03 Jan 2014 23:25:39 GMT
  Content-Type: application/json; charset=utf-8
  Transfer-Encoding: chunked
  Connection: close
  Set-Cookie: tmgioct=52c746f34266840643527780; expires=Mon, 01-Jan-2024 23:25:39 GMT; path=/; httponly
  P3P: CP="ALL ADM DEV PSAi COM OUR OTRo STP IND ONL"
  
  3c
  {"meta":{"status":401,"msg":"Not Authorized"},"response":[]}
  </code></pre>