从 Twitter API 1.1 版开始，每个请求都必须通过 OAuth 1.0a 进行身份验证和签名。在我的 PHP 项目中，我想使用 Twitter 趋势 API，尤其是我想使用 GET 趋势/位置调用。所以它是只读的。现在，要授权请求，这里有一个出色的 Twitter API文档。我们了解到我们必须在 HTTP 请求中发送一个额外的标头，称为“Authorization”，其中包含一个以“OAuth”开头的字符串并包含七个参数：
- oauth_consumer_key
- oauth_nonce
- oauth_signature
- oauth_signature_method
- oauth_timestamp
- oauth_token
- oauth_version
在这七个参数中，上面提到的第三个参数 oauth_signature 有点特殊，因为要构建它的值，您必须包含所有其他参数以及更多参数，然后对其进行签名。再次，这个过程在这里得到了很好的解释。
在注册我的应用程序并获取消费者密钥和秘密以及访问令牌和秘密后，我实施了所有这些步骤。这是我的 PHP 代码（当然，我划掉了秘密）：
$HTTPmethod = 'GET';
$twitterApiBaseUrl = 'https://api.twitter.com/1.1/trends/place.json';
$twitterApiParams = 'id=' . $WOEID;
$twitterApiCallUrl = $twitterApiBaseUrl . '?' . $twitterApiParams;
$OAuthConsumerKey = 'eV78fJOOiObfeytAwvWCg';
$OAuthAccessToken = '1116971396-6uc4xOLziLAdiqOfrtKfuRraa2GdCzas9aQX8ZB';
$OAConsumerSecret = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
$OATokenSecret = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
// building the necessary (as of Twitter API v1.1) authorization header
// according to https://dev.twitter.com/docs/auth/authorizing-request
$DST = 'OAuth ';
// 1.: Consumer key
$oaConsumerKeyKey = rawurlencode("oauth_consumer_key");
$oaConsumerKeyVal = rawurlencode($OAuthConsumerKey);
$DST .= $oaConsumerKeyKey . '="' . $oaConsumerKeyVal . '", ';
// 2.: Nonce
$oaNonceKey = rawurlencode("oauth_nonce");
$oaNonceVal = rawurlencode(base64_encode(time()));
$DST .= $oaNonceKey . '="' . $oaNonceVal . '", ';
// 3.: Signature method
$oaSignatureMethodKey = rawurlencode("oauth_signature_method");
$oaSignatureMethodVal = rawurlencode('HMAC-SHA1');
$DST .= $oaSignatureMethodKey . '="' . $oaSignatureMethodVal . '", ';
// 4.: Timestamp
$oaTimestampKey = rawurlencode("oauth_timestamp");
$oaTimestampVal = rawurlencode(time());
$DST .= $oaTimestampKey . '="' . $oaTimestampVal . '", ';
// 5.: Token
$oaTokenKey = rawurlencode("oauth_token");
$oaTokenVal = rawurlencode($OAuthAccessToken);
$DST .= $oaTokenKey . '="' . $oaTokenVal . '", ';
// 6.: Version
$oaVersionKey = rawurlencode("oauth_version");
$oaVersionVal = rawurlencode('1.0');
$DST .= $oaVersionKey . '="' . $oaVersionVal . '", ';
// 7.: Signature
// according to https://dev.twitter.com/docs/auth/creating-signature
$preSignatureBaseString = $twitterApiParams;
$preSignatureBaseString .= '&';
$preSignatureBaseString .= $oaConsumerKeyKey . '=' . $oaConsumerKeyVal;
$preSignatureBaseString .= '&';
$preSignatureBaseString .= $oaNonceKey . '=' . $oaNonceVal;
$preSignatureBaseString .= '&';
$preSignatureBaseString .= $oaSignatureMethodKey . '=' . $oaSignatureMethodVal;
$preSignatureBaseString .= '&';
$preSignatureBaseString .= $oaTimestampKey . '=' . $oaTimestampVal;
$preSignatureBaseString .= '&';
$preSignatureBaseString .= $oaTokenKey . '=' . $oaTokenVal;
$preSignatureBaseString .= '&';
$preSignatureBaseString .= $oaVersionKey . '=' .$oaVersionVal;
print "<b>preSignatureBaseString:</b> $preSignatureBaseString<p/>\n";
$signatureBaseString = $HTTPmethod;
$signatureBaseString .= '&';
$signatureBaseString .= rawurlencode($twitterApiBaseUrl);
$signatureBaseString .= '&';
$signatureBaseString .= rawurlencode($preSignatureBaseString);
print "<b>signatureBaseString:</b> $signatureBaseString<p/>\n";
$signingKey = rawurlencode($OAConsumerSecret) . '&' . rawurlencode($OATokenSecret);
$oaSignatureKey = rawurlencode("oauth_signature");
$oaSignatureVal = base64_encode(hash_hmac('sha1', $signatureBaseString, $signingKey));
print "<b>oaSignatureVal:</b> $oaSignatureVal<p/>\n";
$DST .= $oaSignatureKey . '="' . rawurlencode($oaSignatureVal) . '"';
print "<b>DST:</b> $DST<p/>\n";
$header = "User-Agent: MyCoolTwitterTrendsApp\r\n" .
"Authorization: " . $DST . "\r\n";
$opts = array(
'http' => array(
'method' => $HTTPmethod,
'header' => $header
));
print "<b>header:</b> $header<p/>\n";
$context = stream_context_create($opts);
$twitterApiResponse = file_get_contents($twitterApiCallUrl, false, $context);
$decodedResponse = json_decode($twitterApiResponse);
echo $decodedResponse;
问题是，每次对 API 的实际调用都会失败，并出现“HTTP/1.0 401 Unauthorized”错误。谁能告诉我为什么以及我在这里做错了什么？太感谢了！