# \[Solved\] Converting curl command with oauth to Thunkable blocks **URL:** \ **Category:** Web API's\ **Created:** [May 17, 2022, 2:24am UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463 "2022-05-17T02:24:39Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [May 17, 2022, 2:24am UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/1 "2022-05-17T02:24:39Z")
I’m trying to access the [Noun Project API](https://thenounproject.com/api/) from Thunkable. I have a curl command that works in Terminal and Postman: ```auto curl --location --request GET 'https://api.thenounproject.com/icons/guitar?limit=30&oauth_consumer_key=[insert key here]&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1652752633&oauth_nonce=Nz9G0aGEvLh&oauth_version=1.0&oauth_signature=ihlp5Vh%2FwSBrYjWrUiJZ6xadR2k%3D' ``` Here it is again: curl --location --request GET ‘[https://api.thenounproject.com/icons/guitar?limit=30&oauth\_consumer\_key=](https://api.thenounproject.com/icons/guitar?limit=30&oauth_consumer_key=)[insert key here]&oauth\_signature\_method=HMAC-SHA1&oauth\_timestamp=1652752633&oauth\_nonce=Nz9G0aGEvLh&oauth\_version=1.0&oauth\_signature=ihlp5Vh%2FwSBrYjWrUiJZ6xadR2k%3D’ But when I try this with my key, it fails and returns the error “Bad Request. Missing OAuth parameters”: (note that the screenshot shows the signature method as “MAC-SHA1” but I fixed this later to read “HMAC-SHA1” ![image](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/1/9/19a4de4074994f76cc47292b5d7f189bbfe7da5f.png) This seems like useful information but I can’t quite piece together what I need: > **[Writing a HTTP API Client in Elixir for the Noun Project](https://www.eidel.io/2017/07/13/http-api-client-elixir-noun-project/)** > > Doing some HTTP requests is usually one of the first things I do when I’m learning a new language (apart from comparing its performance in highly artificial benchmarks and checking whether it scales). ---
**Author:** ![muneer](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/muneer/32/75210_2.png) [@muneer](https://community.thunkable.com/u/muneer)\ **Post date:** [May 17, 2022, 3:27am UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/2 "2022-05-17T03:27:00Z")
Query parameters should be an `object` not a `JSON string` and all parameters should be included. ![image](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/4/6/46b9ffe9e44bda3783d2a8cd2bc05b35670e6684.png) ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [May 17, 2022, 4:21am UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/3 "2022-05-17T04:21:07Z")
I initially tried both with and without the generate JSON block but now when I try your blocks, I get this: 403 Forbidden You don't have the permission to access the requested resource. It is either read-protected or not readable by the server. ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [May 17, 2022, 5:03am UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/4 "2022-05-17T05:03:13Z")
Oh… interesting… that same curl command is now returning the 403 Forbidden error as well. I think it’s probably an invalid timestamp. Just a guess! Edit: if I generate a new curl command from Postman, it works again. So it’s something to do with the timestamp. ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [May 17, 2022, 5:18am UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/5 "2022-05-17T05:18:42Z")
Think I might be in over my head: > **[Authorizing requests | Postman Learning Center](https://learning.postman.com/docs/sending-requests/authorization/#oauth-10)** > > Authorizing requests: documentation for Postman, the collaboration platform for API development. Create better APIs—faster. > **[Creating a signature](https://developer.twitter.com/en/docs/authentication/oauth-1-0a/creating-a-signature)** > **[How to generate siganature, timestamp and nonce?](https://twittercommunity.com/t/how-to-generate-siganature-timestamp-and-nonce/124655/9)** > > have removed result\_type from all sides but my problem continues. My script was as follows: consumer\_key=aaaaaaa consumer\_secret=aaaaaaaaa oauth\_token=aaaaaaaa oauth\_secret=aaaaaaa timestamp=date +%s nonce=date +%s%T | openssl base64 | sed -e... ---
**Author:** ![muneer](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/muneer/32/75210_2.png) [@muneer](https://community.thunkable.com/u/muneer)\ **Post date:** [May 17, 2022, 8:51am UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/6 "2022-05-17T08:51:20Z")
I just had more reading about it and I was wrong. These should not go into the `Query Parameters` block. They are part of the authorization and should go in the `Headers` block. ![image](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/b/d/bd8cf0dcbd1b14a6292538c5649f5fea6afb654f.png) You might need to add quotation marks around the values but it has to be part of the headers as it is an authorization string. If you want it to be part of the parameters block then you need to add in the header `Content-Type=application/x-ww-form-urlencoded` so you can pass the authentication as part of the parameters block or the body block. ---
**Author:** ![Michael\_Rogulla](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@Michael\_Rogulla](https://community.thunkable.com/u/Michael_Rogulla)\ **Post date:** [May 17, 2022, 9:32am UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/7 "2022-05-17T09:32:21Z")
Hi @tatiang , did you realize that the curl-command says “…oauth\_signature\_method=HMAC-SHA1” but your first screenshot shows only “MAC-SHA1” (without “H”)? I don’t know if it makes a difference, just trying to help. ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [May 17, 2022, 10:27am UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/8 "2022-05-17T10:27:10Z")
Yes, thank you, I did catch that. I’ve fixed the blocks but I’ll update the screenshot when I get a chance. ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [May 17, 2022, 3:35pm UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/9 "2022-05-17T15:35:00Z")
I believe Postman sends the values as parameters. If I use an Authorization header in Thunkable, with or without quotes around the entire string or around each value, I get “Invalid query string.” ---
**Author:** ![muneer](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/muneer/32/75210_2.png) [@muneer](https://community.thunkable.com/u/muneer)\ **Post date:** [May 17, 2022, 6:06pm UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/10 "2022-05-17T18:06:57Z")
This is what I made ![image](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/4/b/4b2fa7231c59b91864a9be0e31d613551d4f33f9.png) This is the result from my mobile ![Screenshot_2022-05-17-21-06-18-00_2bbfbfee96a5dfce998f962ebb8b5da3](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/0/d/0d7f91966b6dae1f79507f501bbd855c3d07aa33.jpeg) ---
**Author:** ![tatiang](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/tatiang/32/55482_2.png) [@tatiang](https://community.thunkable.com/u/tatiang)\ **Post date:** [May 17, 2022, 6:46pm UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/11 "2022-05-17T18:46:15Z")
Success!!! Thank you so much for your perserverance helping me. It’s working now. I was missing "OAuth " at the beginning of the text string. I wonder how to [generate a current timestamp, nonce and signature](https://stackoverflow.com/questions/68431545/generate-oauth-1-0-nonce-timestamp-and-signature-using-the-requesturl-consumer). ---
**Author:** ![muneer](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/muneer/32/75210_2.png) [@muneer](https://community.thunkable.com/u/muneer)\ **Post date:** [May 18, 2022, 11:21am UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/12 "2022-05-18T11:21:23Z")
> [@tatiang](#): > > I wonder how to Generating the OAuth 1.0 string is straight forward but involves a lot of steps. - First you need to create what is referred to as `Base String` which is comprised of the method (GET or POST) in uppercase then **&** the URL in lowercase then **&** this should be followed with all parameters in alphabetical order in the form of parameter name then **=** then parameter value then **&** - The `timestamp` should be unix time in seconds only - The `nonce` is any arbitrary text and can be the timestamp but in **milliseconds** - All this should be in URL ENCODED format The next required parameter is the `Base secret` which is the `Customer Key` then **&** then `customer secret` and converted to URL ENCODED. The last step is to create the `Signature` by **hashing** both the `base string` and the `base secret`. The result of the hashing should be in **Base64**. Note that OAuth 1.0 only supports a single hashing method which is **HMAC-SHA1**. Hope this helps. ---
**Author:** ![jared](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/jared/32/138473_2.png) [@jared](https://community.thunkable.com/u/jared)\ **Post date:** [May 18, 2022, 6:24pm UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/13 "2022-05-18T18:24:11Z")
> [@tatiang](#): > > I wonder how to [generate a current timestamp, nonce and signature](https://stackoverflow.com/questions/68431545/generate-oauth-1-0-nonce-timestamp-and-signature-using-the-requesturl-consumer). you could use xano for this. I’m sure there are others but they have [easy to use cryptographic functions](https://docs.xano.com/working-with-data/functions/security) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/0/f/0f59f292712368bce16ff80133ae10de8a6f27e8.png) [@system](https://community.thunkable.com/u/system)\ **Post date:** [August 16, 2022, 6:25pm UTC](https://community.thunkable.com/t/solved-converting-curl-command-with-oauth-to-thunkable-blocks/1879463/14 "2022-08-16T18:25:02Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.