.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man v6.0.2 (Pod::Simple 3.45)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\"
.\" Required to disable full justification in groff 1.23.0.
.if n .ds AD l
.\" ========================================================================
.\"
.IX Title "Net::OAuth 3"
.TH Net::OAuth 3 2026-08-21 "perl v5.42.2" "User Contributed Perl Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
Net::OAuth \- OAuth 1.0 for Perl
.SH SYNOPSIS
.IX Header "SYNOPSIS"
.Vb 1
\&  use Net::OAuth::Client;
\&
\&  # client_id is the Consumer Key, client_secret the Consumer Secret.
\&  # Framework\-agnostic: supply your own redirect and session handling.
\&
\&  my $client = Net::OAuth::Client\->new(
\&      $client_id,
\&      $client_secret,
\&      site               => \*(Aqhttps://provider.example/\*(Aq,
\&      request_token_path => \*(Aq/oauth/request_token\*(Aq,
\&      authorize_path     => \*(Aq/oauth/authorize\*(Aq,
\&      access_token_path  => \*(Aq/oauth/access_token\*(Aq,
\&      callback           => \*(Aqhttps://you.example/auth/callback\*(Aq,
\&      session            => \e&session,
\&  );
\&
\&  # 1. Send the user to the provider to authorize.
\&  $client\->authorize_url;
\&
\&  # 2. They return to your callback with oauth_token and oauth_verifier.
\&  my $access_token = $client\->get_access_token($token, $verifier);
\&
\&  # 3. Use the access token to fetch a protected resource.
\&  my $response = $access_token\->get(\*(Aq/profile\*(Aq);
\&  die $response\->status_line unless $response\->is_success;
\&  print $response\->decoded_content;
.Ve
.SH IMPORTANT
.IX Header "IMPORTANT"
Net::OAuth provides a low\-level API for reading and writing OAuth messages.
.PP
You probably should start with Net::OAuth::Client.
.SH ABSTRACT
.IX Header "ABSTRACT"
OAuth is
.PP
"An open protocol to allow secure API authentication in a simple and standard method from desktop and web applications."
.PP
In practical terms, OAuth is a mechanism for a Consumer to request protected resources from a Service Provider on behalf of a user.
.PP
Please refer to the OAuth spec: <http://oauth.net/documentation/spec>
.PP
Net::OAuth provides:
.IP \(bu 4
classes that encapsulate OAuth messages (requests and responses).
.IP \(bu 4
message signing
.IP \(bu 4
message serialization and parsing.
.IP \(bu 4
2\-legged requests (aka. tokenless requests, aka. consumer requests), see "CONSUMER REQUESTS"
.PP
Net::OAuth does not provide:
.IP \(bu 4
Consumer or Service Provider encapsulation
.IP \(bu 4
token/nonce/key storage/management
.SH DESCRIPTION
.IX Header "DESCRIPTION"
.SS "OAUTH MESSAGES"
.IX Subsection "OAUTH MESSAGES"
An OAuth message is a set of key\-value pairs.  The following message types are supported:
.PP
Requests
.IP \(bu 4
Request Token (Net::OAuth::RequestTokenRequest)
.IP \(bu 4
Access Token (Net::OAuth::AccessTokenRequest)
.IP \(bu 4
User Authentication (Net::OAuth::UserAuthRequest)
.IP \(bu 4
Protected Resource (Net::OAuth::ProtectedResourceRequest)
.IP \(bu 4
Consumer Request (Net::OAuth::ConsumerRequest) (2\-legged / token\-less request)
.PP
Responses
.IP \(bu 4
Request Token (Net::OAuth::RequestTokenResponse)
.IP \(bu 4
Access Token (Net::OAuth:AccessTokenResponse)
.IP \(bu 4
User Authentication (Net::OAuth::UserAuthResponse)
.PP
Each OAuth message type has one or more required parameters, zero or more optional parameters, and most allow arbitrary parameters.
.PP
All OAuth requests must be signed by the Consumer.  Responses from the Service Provider, however, are not signed.
.PP
To create a message, the easiest way is to use the factory methods (Net::OAuth\->request, Net::OAuth\->response, Net::OAuth\->message).  The following method invocations are all equivalent:
.PP
.Vb 4
\& $request = Net::OAuth\->request(\*(Aquser authentication\*(Aq)\->new(%params);
\& $request = Net::OAuth\->request(\*(Aquser_auth\*(Aq)\->new(%params);
\& $request = Net::OAuth\->request(\*(AqUserAuth\*(Aq)\->new(%params);
\& $request = Net::OAuth\->message(\*(AqUserAuthRequest\*(Aq)\->new(%params);
.Ve
.PP
The more verbose way is to use the class directly:
.PP
.Vb 2
\& use Net::OAuth::UserAuthRequest;
\& $request = Net::OAuth::UserAuthRequest\->new(%params);
.Ve
.PP
You can also create a message by deserializing it from a Authorization header, URL, query hash, or POST body
.PP
.Vb 5
\& $request = Net::OAuth\->request(\*(Aqprotected resource\*(Aq)\->from_authorization_header($ENV{HTTP_AUTHORIZATION}, %api_params);
\& $request = Net::OAuth\->request(\*(Aqprotected resource\*(Aq)\->from_url($url, %api_params);
\& $request = Net::OAuth\->request(\*(Aqprotected resource\*(Aq)\->from_hash({$q\->Vars}, %api_params); # CGI
\& $request = Net::OAuth\->request(\*(Aqprotected resource\*(Aq)\->from_hash($c\->request\->params, %api_params); # Catalyst
\& $response = Net::OAuth\->response(\*(Aqrequest token\*(Aq)\->from_post_body($response_content, %api_params);
.Ve
.PP
Note that the deserialization methods (as opposed to \fBnew()\fR) expect OAuth protocol parameters to be prefixed with \*(Aqoauth_\*(Aq, as you would expect in a valid OAuth message.
.PP
Before sending a request, the Consumer must first sign it:
.PP
.Vb 1
\& $request\->sign;
.Ve
.PP
When receiving a request, the Service Provider should first verify the signature, and should say which signature methods it is willing to accept:
.PP
.Vb 6
\& $request = Net::OAuth\->request(\*(Aqprotected resource\*(Aq)\->from_authorization_header(
\&     $ENV{HTTP_AUTHORIZATION},
\&     %api_params,
\&     allowed_signature_methods => [qw/HMAC\-SHA1 HMAC\-SHA256/],
\& );
\& die "Signature verification failed" unless $request\->verify;
.Ve
.PP
See "VERIFYING MESSAGES" for why the second part matters.
.SS "VERIFYING MESSAGES"
.IX Subsection "VERIFYING MESSAGES"
\&\f(CW\*(C`oauth_signature_method\*(C'\fR is a message parameter: it is chosen by whoever
sent the message, and on the receiving side it arrives from the network
along with the signature it describes. \f(CW\*(C`verify\*(C'\fR dispatches on it, so
without an \f(CW\*(C`allowed_signature_methods\*(C'\fR list the sender is choosing which
algorithm \- and therefore which key \- the receiver checks their signature
with.
.PP
That is a real problem for a Service Provider deployed with RSA\-SHA1,
because it holds only the Consumer\*(Aqs \fBpublic\fR key. An attacker who sends
\&\f(CW\*(C`oauth_signature_method=HMAC\-SHA1\*(C'\fR instead moves verification onto the
symmetric path, whose key "signature_key" in Net::OAuth::Request derives
from \f(CW\*(C`consumer_secret\*(C'\fR and \f(CW\*(C`token_secret\*(C'\fR \- fields RSA\-SHA1 does not use
and which such a deployment has no reason to keep secret. The equivalent
downgrade between two symmetric methods (HMAC\-SHA256 to HMAC\-SHA1, or to
PLAINTEXT) is weaker but is the same mechanism.
.PP
Pass \f(CW\*(C`allowed_signature_methods\*(C'\fR as an API parameter to any message you
are going to \f(CW\*(C`verify\*(C'\fR:
.PP
.Vb 1
\& allowed_signature_methods => [qw/RSA\-SHA1/]
.Ve
.PP
\&\f(CW\*(C`verify\*(C'\fR croaks if the message names anything else. Deployments that
cannot reach every call site \- because verification happens inside a
framework or a wrapper module \- can set the process\-wide default instead:
.PP
.Vb 1
\& @Net::OAuth::ALLOWED_SIGNATURE_METHODS = qw/RSA\-SHA1/;
.Ve
.PP
An \f(CW\*(C`allowed_signature_methods\*(C'\fR on the message overrides that default.
.PP
If neither is set, \f(CW\*(C`verify\*(C'\fR croaks. There is no method it could safely
assume on your behalf: only you know which one your Consumers registered
with, and taking the answer from the message is the problem this list
exists to solve.
.PP
Signing is not affected: a Consumer choosing the method for a message it
is about to send is choosing for itself, not on someone else\*(Aqs behalf.
.PP
\fIUpgrading\fR
.IX Subsection "Upgrading"
.PP
This is a breaking change. Before this release \f(CW\*(C`verify\*(C'\fR took the
algorithm from the message; every existing caller is therefore unpinned,
and will croak until it says what it accepts. The migration is one
parameter per verifying call site, or one package variable per process,
naming the method your Consumers already use \- for the great majority of
deployments:
.PP
.Vb 1
\& @Net::OAuth::ALLOWED_SIGNATURE_METHODS = qw/HMAC\-SHA1/;
.Ve
.PP
The break is deliberate: a warning would have left every deployment that
does not read release notes verifying with an attacker\-chosen algorithm.
.PP
When sending a message the last step is to serialize it and send it to wherever it needs to go.  The following serialization methods are available:
.PP
.Vb 1
\& $response\->to_post_body # a application/x\-www\-form\-urlencoded POST body
\&
\& $request\->to_url # the query string of a URL
\&
\& $request\->to_authorization_header # the value of an HTTP Authorization header
\&
\& $request\->to_hash # a hash that could be used for some other serialization
.Ve
.SS "API PARAMETERS vs MESSAGE PARAMETERS"
.IX Subsection "API PARAMETERS vs MESSAGE PARAMETERS"
Net::OAuth defines \*(Aqmessage parameters\*(Aq as parameters that are part of the transmitted OAuth message.  These include any protocol parameter (prefixed with \*(Aqoauth_\*(Aq in the message), and any additional message parameters (the extra_params hash).
.PP
\&\*(AqAPI parameters\*(Aq are parameters required to build a message object that are not transmitted with the message, e.g. consumer_secret, token_secret, request_url, request_method.
.PP
There are various methods to inspect a message class to see what parameters are defined:
.PP
.Vb 7
\& $request\->required_message_params;
\& $request\->optional_message_params;
\& $request\->all_message_params;
\& $request\->required_api_params;
\& $request\->optional_api_params;
\& $request\->all_api_params;
\& $request\->all_params;
.Ve
.PP
E.g.
.PP
.Vb 3
\& use Net::OAuth;
\& use Data::Dumper;
\& print Dumper(Net::OAuth\->request("protected resource")\->required_message_params);
\&
\& $VAR1 = [
\&          \*(Aqconsumer_key\*(Aq,
\&          \*(Aqsignature_method\*(Aq,
\&          \*(Aqtimestamp\*(Aq,
\&          \*(Aqnonce\*(Aq,
\&          \*(Aqtoken\*(Aq
\&        ];
.Ve
.SS "ACCESSING PARAMETERS"
.IX Subsection "ACCESSING PARAMETERS"
All parameters can be get/set using accessor methods. E.g.
.PP
.Vb 2
\& my $consumer_key = $request\->consumer_key;
\& $request\->request_method(\*(AqPOST\*(Aq);
.Ve
.SS "THE REQUEST_URL PARAMETER"
.IX Subsection "THE REQUEST_URL PARAMETER"
Any query parameters in the request_url are removed and added to the extra_params hash when generating the signature.
.PP
E.g. the following requests are pretty much equivalent:
.PP
.Vb 7
\& my $request = Net::OAuth\->request(\*(AqRequest Token\*(Aq)\->new(
\&  %params,
\&  request_url => \*(Aqhttps://photos.example.net/request_token\*(Aq,
\&  extra_params => {
\&   foo => \*(Aqbar\*(Aq
\&  },
\&);
\&
\& my $request = Net::OAuth\->request(\*(AqRequest Token\*(Aq)\->new(
\&  %params,
\&  request_url => \*(Aqhttps://photos.example.net/request_token?foo=bar\*(Aq,
\& );
.Ve
.PP
Calling \f(CW$request\fR\->request_url will still return whatever you set it to originally. If you want to get the request_url with the query parameters removed, you can do:
.PP
.Vb 1
\&    my $url = $request\->normalized_request_url;
.Ve
.SS "SIGNATURE METHODS"
.IX Subsection "SIGNATURE METHODS"
The following signature methods are supported:
.IP \(bu 4
PLAINTEXT
.IP \(bu 4
HMAC\-SHA1
.IP \(bu 4
HMAC\-SHA256
.IP \(bu 4
RSA\-SHA1
.PP
The signature method is determined by the value of the signature_method parameter that is passed to the message constructor.
.PP
If an unknown signature method is specified, the signing/verification will throw an exception.
.PP
\fIPLAINTEXT SIGNATURES\fR
.IX Subsection "PLAINTEXT SIGNATURES"
.PP
This method is a trivial signature which adds no security.  Not recommended.
.PP
\fIHMAC\-SHA1 SIGNATURES\fR
.IX Subsection "HMAC-SHA1 SIGNATURES"
.PP
This method is available if you have Digest::SHA installed.  This is by far the most commonly used method.
.PP
\fIHMAC\-SHA256 SIGNATURES\fR
.IX Subsection "HMAC-SHA256 SIGNATURES"
.PP
This method is available if you have Digest::SHA installed.
.PP
\fIRSA\-SHA1 SIGNATURES\fR
.IX Subsection "RSA-SHA1 SIGNATURES"
.PP
To use RSA\-SHA1 signatures, pass in a Crypt::OpenSSL::RSA object (or any object that can do \f(CW$o\fR\->sign($str) and/or \f(CW$o\fR\->verify($str, \f(CW$sig\fR))
.PP
E.g.
.PP
Consumer:
.PP
.Vb 6
\& use Crypt::OpenSSL::RSA;
\& use File::Slurp;
\& $keystring = read_file(\*(Aqprivate_key.pem\*(Aq);
\& $private_key = Crypt::OpenSSL::RSA\->new_private_key($keystring);
\& $request = Net::OAuth\->request(\*(Aqrequest token\*(Aq)\->new(%params);
\& $request\->sign($private_key);
.Ve
.PP
Service Provider:
.PP
.Vb 11
\& use Crypt::OpenSSL::RSA;
\& use File::Slurp;
\& $keystring = read_file(\*(Aqpublic_key.pem\*(Aq);
\& $public_key = Crypt::OpenSSL::RSA\->new_public_key($keystring);
\& $request = Net::OAuth\->request(\*(Aqrequest token\*(Aq)\->new(
\&     %params,
\&     allowed_signature_methods => [\*(AqRSA\-SHA1\*(Aq],
\& );
\& if (!$request\->verify($public_key)) {
\&        die "Signature verification failed";
\& }
.Ve
.PP
A Service Provider deployed this way holds only the Consumer\*(Aqs public
key, so it is the deployment with the most to lose from letting the
message choose the algorithm: without \f(CW\*(C`allowed_signature_methods\*(C'\fR a
request naming HMAC\-SHA1 would be checked against \f(CW\*(C`consumer_secret\*(C'\fR,
which RSA\-SHA1 does not use and such a deployment has no reason to keep
secret. See "VERIFYING MESSAGES".
.PP
Note that you can pass the key in as a parameter called \*(Aqsignature_key\*(Aq to the message constructor, rather than passing it to the sign/verify method, if you like.
.SS "CONSUMER REQUESTS"
.IX Subsection "CONSUMER REQUESTS"
To send a request without including a token, use a Consumer Request:
.PP
.Vb 9
\&    my $request = Net::OAuth\->request(\*(Aqconsumer\*(Aq)\->new(
\&            consumer_key => \*(Aqdpf43f3p2l4k3l03\*(Aq,
\&            consumer_secret => \*(Aqkd94hf93k423kf44\*(Aq,
\&            request_url => \*(Aqhttp://provider.example.net/profile\*(Aq,
\&            request_method => \*(AqGET\*(Aq,
\&            signature_method => \*(AqHMAC\-SHA1\*(Aq,
\&            timestamp => \*(Aq1191242096\*(Aq,
\&            nonce => \*(Aqkllo9940pd9333jh\*(Aq,
\&    );
\&
\&    $request\->sign;
.Ve
.PP
See Net::OAuth::ConsumerRequest
.SS I18N
.IX Subsection "I18N"
Per the OAuth spec, when making the signature Net::OAuth first encodes parameters to UTF\-8. This means that any parameters you pass to Net::OAuth, if they might be outside of ASCII character set, should be run through \fBEncode::decode()\fR (or an equivalent PerlIO layer) first to decode them to Perl\*(Aqs internal character structure.
.SS "OAUTH 1.0A"
.IX Subsection "OAUTH 1.0A"
Background:
.PP
<http://mojodna.net/2009/05/20/an\-idiots\-guide\-to\-oauth\-10a.html>
.PP
<http://oauth.googlecode.com/svn/spec/core/1.0a/drafts/3/oauth\-core\-1_0a.html>
.PP
Net::OAuth defaults to OAuth 1.0 spec compliance, and supports OAuth 1.0 Rev A with an optional switch:
.PP
.Vb 2
\& use Net::OAuth
\& $Net::OAuth::PROTOCOL_VERSION = Net::OAuth::PROTOCOL_VERSION_1_0A;
.Ve
.PP
It is recommended that any new projects use this switch if possible, and existing projects move to supporting this switch as soon as possible.  Probably the easiest way for existing projects to do this is to turn on the switch and run your test suite.  The Net::OAuth constructor will throw an exception where the new protocol parameters (callback, callback_confirmed, verifier) are missing.
.PP
Internally, the Net::OAuth::Message constructor checks \f(CW$Net::OAuth::PROTOCOL_VERSION\fR and attempts to load the equivalent subclass in the Net::OAuth::V1_0A:: namespace.  So if you instantiate a Net::OAuth::RequestTokenRequest object, you will end up with a Net::OAuth::V1_0A::RequestTokenRequest (a subclass of Net::OAuth::RequestTokenRequest) if the protocol version is set to PROTOCOL_VERSION_1_0A.  You can also select a 1.0a subclass on a per\-message basis by passing
.PP
.Vb 1
\&    protocol_version => Net::OAuth::PROTOCOL_VERSION_1_0A
.Ve
.PP
in the API parameters hash.
.PP
If you are not sure whether the entity you are communicating with is 1.0A compliant, you can try instantiating a 1.0A message first and then fall back to 1.0 if that fails:
.PP
.Vb 10
\&    use Net::OAuth
\&    $Net::OAuth::PROTOCOL_VERSION = Net::OAuth::PROTOCOL_VERSION_1_0A;
\&    my $is_oauth_1_0 = 0;
\&    my $response = eval{Net::OAuth\->response(\*(Aqrequest token\*(Aq)\->from_post_body($res\->content)};
\&    if ($@) {
\&        if ($@ =~ /Missing required parameter \*(Aqcallback_confirmed\*(Aq/) {
\&            # fall back to OAuth 1.0
\&            $response = Net::OAuth\->response(\*(Aqrequest token\*(Aq)\->from_post_body(
\&                $res\->content,
\&                protocol_version => Net::OAuth::PROTOCOL_VERSION_1_0
\&            );
\&            $is_oauth_1_0 = 1; # from now on treat the server as OAuth 1.0 compliant
\&        }
\&        else {
\&            die $@;
\&        }
\&    }
.Ve
.PP
At some point in the future, Net::OAuth will default to Net::OAuth::PROTOCOL_VERSION_1_0A.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
<http://oauth.net>
.PP
Check out Net::OAuth::Simple \- it has a simpler API that may be more to your liking
.PP
Check out Net::Twitter::OAuth for a Twitter\-specific OAuth API
.PP
Check out WWW::Netflix::API for a Netflix\-specific OAuth API
.SH TODO
.IX Header "TODO"
.IP \(bu 4
Support for repeating/multivalued parameters
.IP \(bu 4
Add convenience methods for SPs
.Sp
Something like:
.Sp
.Vb 2
\&    # direct from CGI.pm object
\&    $request = Net::OAuth\->request(\*(AqRequest Token\*(Aq)\->from_cgi_query($cgi, %api_params);
\&
\&    # direct from Catalyst::Request object
\&    $request = Net::OAuth\->request(\*(AqRequest Token\*(Aq)\->from_catalyst_request($c\->req, %api_params);
\&
\&    # from Auth header and GET and POST params in one
\&    local $/;
\&    my $post_body = <STDIN>;
\&    $request = Net::OAuth\->request(\*(AqRequest Token\*(Aq)\->from_auth_get_and_post(
\&        $ENV{HTTP_AUTHORIZATION},
\&        $ENV{QUERY_STRING},
\&        $post_body,
\&        %api_params
\&    );
.Ve
.SH AUTHOR
.IX Header "AUTHOR"
Originally by Keith Grennan <foss@nearlyfree.org>
.PP
Currently maintained by Robert Rothenberg <perl@rhizomnic.com>
.SH CONTRIBUTORS
.IX Header "CONTRIBUTORS"
Adam Taylor
.PP
Brad Whitaker
.PP
Cosimo Streppone <cosimo@cpan.org>
.PP
Daisuke Maki
.PP
Gregor Herrmann
.PP
James Raspass <jraspass@gmail.com>
.PP
Jeff Dairiki
.PP
Jens Rehsack
.PP
Katou Akira
.PP
Masayoshi Sekimura
.PP
Marc Mims
.PP
Mike Schleif
.PP
Nobuo Danjou
.PP
Pattawan Gerlings\-Kaewduangdee (oiami)
.PP
Sergey Romanov <sromanov\-dev@yandex.ru>
.PP
Shawn Moore <cpan@sartak.org>
.PP
Simon Wistow
.PP
Tomaž Šolc <avian@cpan.org>
.SH "COPYRIGHT & LICENSE"
.IX Header "COPYRIGHT & LICENSE"
Copyright 2007\-2012, 2024\-2026 Keith Grennan
.PP
This program is free software; you can redistribute it and/or modify it
under the same terms as Perl itself.