How OAuth 0-Legged Works

OAuth 0-legged authentication requires you to include OAuth details in the Authorization header of every request. The header format is:

Authorization: OAuth oauth_consumer_key="YOUR_CONSUMER_KEY",
    oauth_signature_method="HMAC-SHA1",
    oauth_timestamp="TIMESTAMP",
    oauth_nonce="UNIQUE_RANDOM_STRING",
    oauth_version="1.0",
    oauth_signature="COMPUTED_SIGNATURE"

OAuth Parameters

Signature Generation Process

To generate the OAuth signature, follow these steps:

1. Normalize the URL: Parse the request URL and build a normalized version (scheme://host:port/path). Include port only if it's non-standard (not 80 for HTTP, not 443 for HTTPS).
2. Collect parameters: Gather all OAuth parameters (consumer key, timestamp, nonce, version, signature method) and any query parameters from the URL. Exclude the oauth_signature parameter itself.
3. Normalize parameters: Sort all parameters alphabetically by key, then URL-encode each key and value, joining them with = and separating pairs with &.
4. Build signature base string: Create a string in the format METHOD&URL&PARAMS where METHOD is the HTTP method (e.g., POST), URL is the normalized URL, and PARAMS is the normalized parameter string. URL-encode each component.
5. Generate signature: Create a signing key by URL-encoding your consumer secret and appending & (since we don't use tokens). Then compute the HMAC-SHA1 hash of the signature base string using the signing key, and base64-encode the result.

Required Headers

Every API request must include the following headers:

• Authorization: OAuth 1.0 authorization header with all OAuth parameters and signature
• Content-Type: application/json
• X-Payload-Signature: SHA256 hash of the JSON request body concatenated with your consumer key and the OAuth signature

Code Implementation

Here are the PHP functions to implement the signature generation process:

function generateOAuthParams(string $method, string $url, string $consumerKey, string $consumerSecret): array
{
    $params = [
        'oauth_consumer_key' => $consumerKey,
        'oauth_signature_method' => 'HMAC-SHA1',
        'oauth_timestamp' => (string) time(),
        'oauth_nonce' => bin2hex(random_bytes(8)),
        'oauth_version' => '1.0',
    ];

    $params['oauth_signature'] = generateSignature($method, $url, $params, $consumerSecret);

    return $params;
}

function generateSignature(string $method, string $url, array $params, string $consumerSecret): string
{
    // Parse and normalize URL
    $parsedUrl = parse_url($url);
    $scheme = $parsedUrl['scheme'] ?? 'http';
    $host = $parsedUrl['host'] ?? 'localhost';
    $port = $parsedUrl['port'] ?? null;
    $path = isset($parsedUrl['path']) ? ltrim($parsedUrl['path'], '/') : '';

    // Build normalized URL
    $normalizedUrl = $scheme . '://' . $host;
    if (($scheme === 'http' && $port !== null && $port !== 80) ||
        ($scheme === 'https' && $port !== null && $port !== 443)) {
        $normalizedUrl .= ':' . $port;
    }
    $normalizedUrl .= '/' . $path;

    // Get query parameters from URL
    $queryParams = [];
    if (isset($parsedUrl['query'])) {
        parse_str($parsedUrl['query'], $queryParams);
    }

    // Combine OAuth params and query params (excluding oauth_signature)
    $allParams = array_merge($params, $queryParams);
    unset($allParams['oauth_signature']);

    // Sort parameters
    ksort($allParams);

    // Normalize parameters
    $normalizedParams = [];
    foreach ($allParams as $key => $value) {
        $normalizedParams[] = urlencode($key) . '=' . urlencode((string) $value);
    }
    $paramString = implode('&', $normalizedParams);

    // Build signature base string: METHOD&URL&PARAMS
    $signatureBaseString = urlencode($method) . '&' . urlencode($normalizedUrl) . '&' . urlencode($paramString);

    // Build signing key (consumer secret + empty token secret)
    $signingKey = urlencode($consumerSecret) . '&';

    // Generate HMAC-SHA1 signature
    $signature = base64_encode(hash_hmac('sha1', $signatureBaseString, $signingKey, true));

    return $signature;
}

function buildAuthorizationHeader(array $oauthParams): string
{
    $header = 'OAuth ';
    $headerParts = [];

    foreach ($oauthParams as $key => $value) {
        if (strpos($key, 'oauth_') === 0) {
            $headerParts[] = urlencode($key) . '="' . urlencode((string) $value) . '"';
        }
    }

    $header .= implode(', ', $headerParts);

    return $header;
}

Complete Example

Here's a complete example of making an authenticated request:

$consumerKey = 'YOUR_CONSUMER_KEY';
$consumerSecret = 'YOUR_CONSUMER_SECRET';
$apiUrl = 'https://api.bitmesh.ai/chat';

// Prepare request payload
$payload = [
    'model' => 'meta-llama/Llama-3.2-3B-Instruct-Turbo',
    'messages' => [
        ['role' => 'user', 'content' => 'What are some fun things to do with AI?'],
    ],
];
$jsonBody = json_encode($payload);

// Generate OAuth signature
$method = 'POST';
$oauthParams = generateOAuthParams($method, $apiUrl, $consumerKey, $consumerSecret);
$authHeader = buildAuthorizationHeader($oauthParams);

// Generate payload signature
$payloadSignature = hash('sha256', $jsonBody . $consumerKey . $oauthParams['oauth_signature']);

// Make request
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $apiUrl,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: ' . $authHeader,
        'Accept: application/json',
        'Content-Type: application/json',
        'X-Payload-Signature: ' . $payloadSignature,
    ],
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $jsonBody,
]);

$response = curl_exec($ch);
curl_close($ch);