title: Authorization OAuth 1.0 works with Postman, fails via Node.js
body: <p>I am trying to authorize my application with <a href="https://developer.here.com/" rel="nofollow noreferrer">HERE, the open API for maps</a> and following their instructions <a href="https://developer.here.com/documentation/authentication/dev_guide/topics/using-postman.html" rel="nofollow noreferrer">here</a> I am able to retrieve an <code>accessToken</code>. However, when I try to sign the request using Node.js' <code>crypto</code>, the signature I am getting is different than the one provided by Postman.</p>
  
  <p>Here is the HTTP code snippet from Postman:</p>
  
  <pre><code>POST /oauth2/token HTTP/1.1
  Host: account.api.here.com
  Authorization: OAuth oauth_consumer_key="apiKey",
      oauth_signature_method="HMAC-SHA256",
      oauth_timestamp="1591720243",
      oauth_nonce="X6Ukw2TWTBp",
      oauth_version="1.0",
      oauth_signature="rqXoIM8YOYpsLjcWZ5Yau15%2BDIwPHhj%2B7jk8xyAfpU4%3D"
  Content-Type: application/x-www-form-urlencoded
  
  grant_type=client_credentials
  </code></pre>
  
  <p>Here is my Node.js code: </p>
  
  <pre><code>crypto = require('crypto'),
  apiKey = 'apiKey',
  url = 'https://account.api.here.com/oauth2/token',
  sharedSecret = 'sharedSecret'
  
  var reqObj = {
      oauth_consumer_key: apiKey,
      oauth_nonce: "X6Ukw2TWTBp",
      oauth_signature_method: "HMAC-SHA256",
      oauth_timestamp: "1591720243",
      oauth_version: "1.0"
  };
  
  var paramsStr = '';
  for (var i in reqObj) {
    paramsStr += "&amp;" + i + "=" + reqObj[i];
  }
  
  // had an extra '&amp;' at the front
  paramsStr = paramsStr.substr(1);
  
  var sigBaseStr = "POST&amp;" + encodeURIComponent(url) + "&amp;" + encodeURIComponent(paramsStr);
  
  // no access token but we still have to append '&amp;' according to the instructions
  sharedSecret += "&amp;";
  
  var hashedBaseStr  = crypto.createHmac('sha256', sharedSecret).update(sigBaseStr).digest('base64');
  console.log(encodeURIComponent(hashedBaseStr));
  </code></pre>
  
  <p>The above code ouputs the following: <code>fWmRNPpjrbBkVBQiS8DhjTo6G%2B5Tpeb6PZAxNVo7sWc%3D</code>. While from Postman's header, you can see that the signature is <code>rqXoIM8YOYpsLjcWZ5Yau15%2BDIwPHhj%2B7jk8xyAfpU4%3D</code>.</p>
  
  <p>I even followed the tutorial on <a href="http://lti.tools/oauth/" rel="nofollow noreferrer">this page</a>, but it is returning the exact same signature as my code, which does not translate into a valid request.</p>
  
  <p>Can someone please point me to where the issue is in my code? I have already checked that the <code>sigBaseStr</code> follows the requests listed in the OAuth 1.0 specs, so I am not sure what else might be the issue.</p>
  
  <p>To sumarize, I want <strong>my code</strong> to output <code>rqXoIM8YOYpsLjcWZ5Yau15%2BDIwPHhj%2B7jk8xyAfpU4%3D</code>.</p>
  
  <p>Any guidance is highly appreciated.</p>