---
product: Chilkat
product_version: 11.7.0
language: js
language_label: JavaScript
class: OAuth1
license: bundle
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/jsOAuth1Ref.html
---
# Chilkat OAuth1 — JavaScript — v11.7.0

> Chilkat 11.7.0 · language=js · class=OAuth1
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/OAuth1.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/js/guide.md`.

## Purpose

**Generate OAuth 1.0 signatures, authorization headers, and signed request URLs.**

`Chilkat.OAuth1` builds the signed OAuth 1.0 authentication data needed for APIs that still require OAuth 1.0 request signing. It can generate the signature base string, HMAC key, signature, URL-encoded signature, normalized signed parameter string, Authorization header, and generated URL containing OAuth query parameters. It supports consumer credentials, access tokens, nonce and timestamp generation, extra signed parameters, optional realm handling, HMAC-SHA1, HMAC-SHA256, RSA-SHA1, and RSA-SHA256 signing.

**OAuth 1.0 signing**

Generate the OAuth 1.0 signature and related authentication values from the HTTP method, request URL, credentials, token, nonce, and timestamp.

**Authorization header**

Produce the value to send in the HTTP `Authorization` header when OAuth parameters should be supplied as a header.

**Signed URL output**

Generate a URL that includes the OAuth 1.0 query parameters when the API expects authentication data in the request URL.

**Extra signed parameters**

Add or remove request-specific name/value parameters that must be included in the normalized parameter string and signature calculation.

**HMAC or RSA signatures**

Sign with `HMAC-SHA1`, `HMAC-SHA256`, `RSA-SHA1`, or `RSA-SHA256`, with RSA private keys supplied by `SetRsaKey`.

**Debuggable signing details**

Inspect the exact `BaseString`, `HmacKey`, `QueryString`, `Signature`, and `EncodedSignature` used to build the OAuth request.

**Common pattern:** Set `OauthMethod` and `OauthUrl`, provide the consumer key and secret, set any token and token secret, generate or assign `Nonce` and `Timestamp`, add request parameters with `AddParam`, then call `Generate`. Use `AuthorizationHeader` when sending OAuth data in an HTTP header, or `GeneratedUrl` when the signed OAuth parameters should be placed in the URL.

**URL guidance:** Set `OauthUrl` to the base request URL without query parameters. Add query parameters separately with `AddParam` so they are included correctly in the OAuth 1.0 signature calculation.

## Object creation, unlocking and error handling

**Object Creation**

Note: This is intended for running within a [Chilkat.Js embedded JavaScript engine](https://www.chilkatsoft.com/chilkat_javascript_engine.asp).

```
var obj = new CkOAuth1();
```

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in JavaScript.

How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `DebugLogFilePath` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `LastErrorHtml` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `LastErrorText` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `LastErrorXml` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `LastMethodSuccess` | read/write | Indicates the success or failure of the most recent method call: `true` means success, `false` means failure. |
| `VerboseLogging` | `VerboseLogging` | read/write | If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `Version` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `AuthorizationHeader` | property, read-only | `AuthorizationHeader` |
| `BaseString` | property, read-only | `BaseString` |
| `ConsumerKey` | property, read/write | `ConsumerKey` |
| `ConsumerSecret` | property, read/write | `ConsumerSecret` |
| `EncodedSignature` | property, read-only | `EncodedSignature` |
| `GeneratedUrl` | property, read-only | `GeneratedUrl` |
| `HmacKey` | property, read-only | `HmacKey` |
| `Nonce` | property, read/write | `Nonce` |
| `OauthMethod` | property, read/write | `OauthMethod` |
| `OauthUrl` | property, read/write | `OauthUrl` |
| `OauthVersion` | property, read/write | `OauthVersion` |
| `QueryString` | property, read-only | `QueryString` |
| `Realm` | property, read/write | `Realm` |
| `Signature` | property, read-only | `Signature` |
| `SignatureMethod` | property, read/write | `SignatureMethod` |
| `Timestamp` | property, read/write | `Timestamp` |
| `Token` | property, read/write | `Token` |
| `TokenSecret` | property, read/write | `TokenSecret` |
| `UncommonOptions` | property, read/write | `UncommonOptions` |
| `AddParam` | method | `var success = AddParam(name, value);` |
| `Generate` | method | `var success = Generate();` |
| `GenNonce` | method | `var success = GenNonce(numBytes);` |
| `GenTimestamp` | method | `var success = GenTimestamp();` |
| `RemoveParam` | method | `var success = RemoveParam(name);` |
| `SetRsaKey` | method | `var success = SetRsaKey(privKey);` |

## Properties

### OAuth1.AuthorizationHeader

`Chilkat 11.7.0 · js · OAuth1 · AuthorizationHeader · property · read-only · since 9.5.0.53`

```javascript
AuthorizationHeader
```

· `string`, `read-only`

The authorization header. This is what would be included in the Authorization HTTP request header if it is going to be used as the means for providing the OAuth1 authorization information.

### OAuth1.BaseString

`Chilkat 11.7.0 · js · OAuth1 · BaseString · property · read-only · since 9.5.0.53`

```javascript
BaseString
```

· `string`, `read-only`

This is the exact string that was signed. For example, if the signature method is HMAC-SHA1, the BaseString is the exact string that passed to the HMAC-SHA1. An application does not set the BaseString property. The BaseString is exposed as a property to allow for debugging and to see the exact string that is signed.

### OAuth1.ConsumerKey

`Chilkat 11.7.0 · js · OAuth1 · ConsumerKey · property · read/write · since 9.5.0.53`

```javascript
ConsumerKey
```

· `string`

The consumer key.

### OAuth1.ConsumerSecret

`Chilkat 11.7.0 · js · OAuth1 · ConsumerSecret · property · read/write · since 9.5.0.53`

```javascript
ConsumerSecret
```

· `string`

The consumer secret.

### OAuth1.EncodedSignature

`Chilkat 11.7.0 · js · OAuth1 · EncodedSignature · property · read-only · since 9.5.0.53`

```javascript
EncodedSignature
```

· `string`, `read-only`

The URL encoded representation of the Signature property

### OAuth1.GeneratedUrl

`Chilkat 11.7.0 · js · OAuth1 · GeneratedUrl · property · read-only · since 9.5.0.53`

```javascript
GeneratedUrl
```

· `string`, `read-only`

The URL that includes the OAuth1 query params.

### OAuth1.HmacKey

`Chilkat 11.7.0 · js · OAuth1 · HmacKey · property · read-only · since 9.5.0.53`

```javascript
HmacKey
```

· `string`, `read-only`

The exact HMAC key used to sign the BaseString. An application does not directly set the HmacKey. The HmacKey property is read-only and is provided for debugging to see the exact HMAC key used to sign the BaseString. The HMAC key is composed from the consumer secret (if it exists) and the token secret (if it exists).

### OAuth1.Nonce

`Chilkat 11.7.0 · js · OAuth1 · Nonce · property · read/write · since 9.5.0.53`

```javascript
Nonce
```

· `string`

The nonce.

### OAuth1.OauthMethod

`Chilkat 11.7.0 · js · OAuth1 · OauthMethod · property · read/write · since 9.5.0.53`

```javascript
OauthMethod
```

· `string`

The HTTP method, such as `GET`, `POST`, `PUT`, `DELETE`, or `HEAD`. Defaults to `GET`.

### OAuth1.OauthUrl

`Chilkat 11.7.0 · js · OAuth1 · OauthUrl · property · read/write · since 9.5.0.53`

```javascript
OauthUrl
```

· `string`

The OAuth URL, such as `http://echo.lab.madgex.com/echo.ashx`. See http://bettiolo.github.io/oauth-reference-page/ to compare Chilkat results with another tool's results.

**Note:** The OAuthUrl should not include query parameters. For example, do not set the OAuthUrl equal to

```
https://rest.sandbox.netsuite.com/app/site/hosting/restlet.nl?script=165&deploy=1
```

Instead, set OAuthUrl equal to

```
https://rest.sandbox.netsuite.com/app/site/hosting/restlet.nl
```

and then subsequently call AddParam for each query parameter.

### OAuth1.OauthVersion

`Chilkat 11.7.0 · js · OAuth1 · OauthVersion · property · read/write · since 9.5.0.53`

```javascript
OauthVersion
```

· `string`

The oauth_version. Defaults to `1.0`. May be set to the empty string to exclude.

### OAuth1.QueryString

`Chilkat 11.7.0 · js · OAuth1 · QueryString · property · read-only · since 9.5.0.53`

```javascript
QueryString
```

· `string`, `read-only`

Contains the normalized set of request parameters that are signed. This is a read-only property made available for debugging purposes.

### OAuth1.Realm

`Chilkat 11.7.0 · js · OAuth1 · Realm · property · read/write · since 9.5.0.70`

```javascript
Realm
```

· `string`

The realm (optional).

### OAuth1.Signature

`Chilkat 11.7.0 · js · OAuth1 · Signature · property · read-only · since 9.5.0.53`

```javascript
Signature
```

· `string`, `read-only`

The generated base64 signature.

### OAuth1.SignatureMethod

`Chilkat 11.7.0 · js · OAuth1 · SignatureMethod · property · read/write · since 9.5.0.53`

```javascript
SignatureMethod
```

· `string`

The signature method. Defaults to `HMAC-SHA1`. Other possible choices are `HMAC-SHA256`, `RSA-SHA1`, and `RSA-SHA256` (or the equivalent `RSA-SHA2`).

### OAuth1.Timestamp

`Chilkat 11.7.0 · js · OAuth1 · Timestamp · property · read/write · since 9.5.0.53`

```javascript
Timestamp
```

· `string`

The timestamp, such as `1441632569`.

### OAuth1.Token

`Chilkat 11.7.0 · js · OAuth1 · Token · property · read/write · since 9.5.0.53`

```javascript
Token
```

· `string`

The token.

### OAuth1.TokenSecret

`Chilkat 11.7.0 · js · OAuth1 · TokenSecret · property · read/write · since 9.5.0.53`

```javascript
TokenSecret
```

· `string`

The token secret

### OAuth1.UncommonOptions

`Chilkat 11.7.0 · js · OAuth1 · UncommonOptions · property · read/write · since 9.5.0.85`

```javascript
UncommonOptions
```

· `string`

This is a catch-all property to be used for uncommon needs. This property defaults to the empty string and should typically remain empty.

Can be set to a list of the following comma separated keywords:

- `INCLUDE_REALM` - Introduced in v9.5.0.85. Include the Realm in the signature calculation and outputs.

## Methods

### OAuth1.AddParam

`Chilkat 11.7.0 · js · OAuth1 · AddParam · method · since 9.5.0.53`

```javascript
var success = AddParam(name, value);
```

· return: `boolean`; `true` for success, `false` for failure  
· name: `string`  
· value: `string`

Adds an extra name/value parameter to the OAuth1 signature.

Returns true for success, false for failure.

### OAuth1.Generate

`Chilkat 11.7.0 · js · OAuth1 · Generate · method · since 9.5.0.53`

```javascript
var success = Generate();
```

· return: `boolean`; `true` for success, `false` for failure

Generate the signature based on the property settings. Input properties are OauthVersion, OauthMethod, Url, ConsumerKey, ConsumerSecret, Token, TokenSecret, Nonce, and Timestamp. Properties set by this method include: BaseString, Signature, HmacKey, EncodedSignature, QueryString, GeneratedUrl, andAuthorizationHeader.

Returns true for success, false for failure.

### OAuth1.GenNonce

`Chilkat 11.7.0 · js · OAuth1 · GenNonce · method · since 9.5.0.55`

```javascript
var success = GenNonce(numBytes);
```

· return: `boolean`; `true` for success, `false` for failure  
· numBytes: `int`

Generates a random nonce `numBytes` in length and sets the Nonce property to the hex encoded value.

Returns true for success, false for failure.

### OAuth1.GenTimestamp

`Chilkat 11.7.0 · js · OAuth1 · GenTimestamp · method · since 9.5.0.55`

```javascript
var success = GenTimestamp();
```

· return: `boolean`; `true` for success, `false` for failure

Sets the Timestamp property to the current date/time.

Returns true for success, false for failure.

### OAuth1.RemoveParam

`Chilkat 11.7.0 · js · OAuth1 · RemoveParam · method · since 9.5.0.53`

```javascript
var success = RemoveParam(name);
```

· return: `boolean`; `true` for success, `false` for failure  
· name: `string`

Removes a name/value parameter from the OAuth1 signature.

Returns true for success, false for failure.

### OAuth1.SetRsaKey

`Chilkat 11.7.0 · js · OAuth1 · SetRsaKey · method · since 9.5.0.64`

```javascript
var success = SetRsaKey(privKey);
```

· return: `boolean`; `true` for success, `false` for failure  
· privKey: `CkPrivateKey`

Sets the RSA key to be used when the SignatureMethod is set to `RSA-SHA1` or `RSA-SHA2`.

Returns true for success, false for failure.

## Related classes

[`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/js/classes/PrivateKey.md)