When using the Services API with a PUT request, it returns an error saying that the signature is invalid. When working with POST I was getting access denied because the bundle was specified but this seems to be completely different.

401 Unauthorized : Invalid signature 21
["Invalid signature"]

For testing purposes, "Cache pages for anonymous users" and "Cache blocks" are both unchecked. I cleared the cache once to make sure it wasn't that.

It appears to be that the server generated signature does not match, but I saw the answer below, and the two signatures are completely different, not just missing a plus sign. I was able to log the signatures that the server sees to the devel debug log.

Service request with OAuth (Invalid signature error)

One thing I noticed which I wasn't sure about is that the base string that got logged for the request on the server started with GET, but this is a PUT request. Is that normal or could that be a bug in the implementation? My Oauth client is using PUT as the method.

Update: In looking into it, that does indeed seem to be the problem or at least part of it.

if($_SERVER['REQUEST_URI'] == '/api/rest/resource/18.json'){
    die('hi put' . $_SERVER['REQUEST_METHOD']);

The above code inserted at the beginning of index.php gives me hi putGET. However POST works perfectly fine.

My access log has this line

"PUT /api/rest/resource/21.json HTTP/1.1" 401 21 "empty referrer" "My User Agent String"

1 Answer 1


Once I figured out that the access log was different than the $_SERVER variable, I called my hosting provider and discovered that their servers are only configured to allow GET and POST (haven't checked HEAD).

So I invented this hack to use the header, since it seems that Apache just transparently changes unrecognized methods to GET.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.