oAuth 1.0 - getting request token with VBA

1

1

I tried VBA-Web for Upwork API authentication. Unfortunately I'm new to oAuth and the examples on how to use VBA-Web authentication are based on classes designed for APIs with quite different authentication flow.

I'm stuck at the very first step - obtaining request token. From what I've noticed, in VBA-Web examples, it is treated as already known string:

Upwork API oAuth documentation

I found functions which allow me to generate correct timestamp and nonce. From oAuth 1.0 documentation I understand that parameters in my request must be sorted alphabetically. However I have no idea how to construct signature, especially that Base String (authBase variable in my code which is for now null string) creation function in VBA-Web requires specifying token.

Here is my current code, any help on leading me in a good direction is greatly appreciated:

Option Explicit

Public Sub APIauth()

   Const ApiKey As String = "XXXXXXXX"
   Const apiSecret As String = "XXXXXXXX"
   Const mySignatureMethod As String = "HMAC-SHA1"
   Const apiEntry = "https://www.upwork.com/api/"

   Dim myRequest As Object
   Dim urlName As String, requestString As String, authBase As String
   Dim mySignature As String, myTimestamp As String, myNonce As String

   Set myRequest = CreateObject("WinHttp.WinHttpRequest.5.1")

   urlName = apiEntry & "auth/v1/oauth/token/request"

   myNonce = CreateNonce
   myTimestamp = LocalToTimestamp(Now)

   authBase = ""
   mySignature = HMACSHA1(authBase, apiSecret, "Base64")

   requestString = "&oauth_consumer_key=" & ApiKey & _
                "&oauth_nonce=" & myNonce & _
                "&oauth_signature=" & mySignature & _
                "&oauth_signature_method=" & mySignatureMethod & _
                "&oauth_timestamp=" & myTimestamp '& _
                "&oauth_callback="
End Sub

Ryszard Jędraszyk

Posted 2018-05-31T12:10:26.443

Reputation: 133

I hope that's not your actual API key and secret?... (It's still in the history, to you might want to disable them and re-create) – Attie – 2018-05-31T12:23:35.097

Of course not. I changed characters while preserving length. – Ryszard Jędraszyk – 2018-05-31T12:24:22.027

Why are you using oAuth 1.0 when it’s been discontinued? – Ramhound – 2018-05-31T16:36:47.647

Upwork API uses oAuth 1.0, do I have a choice? – Ryszard Jędraszyk – 2018-05-31T16:38:41.667

No answers