{"record":{"id":"027ff7bac66d207d","repo":"restsharp/RestSharp","slug":"only-hmac-sha1-hmac-sha256-and-rsa-sha1-are-curr","errorCode":null,"errorMessage":"Only HMAC-SHA1, HMAC-SHA256, and RSA-SHA1 are currently supported.","messagePattern":"Only HMAC-SHA1, HMAC-SHA256, and RSA-SHA1 are currently supported\\.","errorType":"exception","errorClass":"NotImplementedException","httpStatus":null,"severity":"error","filePath":"src/RestSharp/Authenticators/OAuth/OAuthTools.cs","lineNumber":232,"sourceCode":"        OAuthSignatureMethod    signatureMethod,\n        OAuthSignatureTreatment signatureTreatment,\n        string                  signatureBase,\n        string?                 consumerSecret,\n        string?                 tokenSecret = null\n    ) {\n        if (tokenSecret.IsEmpty()) tokenSecret       = string.Empty;\n        if (consumerSecret.IsEmpty()) consumerSecret = string.Empty;\n\n        var unencodedConsumerSecret = consumerSecret;\n        consumerSecret = Uri.EscapeDataString(consumerSecret);\n        tokenSecret    = Uri.EscapeDataString(tokenSecret);\n\n        var signature = signatureMethod switch {\n            HmacSha1   => GetHmacSignature(new HMACSHA1(), consumerSecret, tokenSecret, signatureBase),\n            HmacSha256 => GetHmacSignature(new HMACSHA256(), consumerSecret, tokenSecret, signatureBase),\n            RsaSha1    => GetRsaSignature(),\n            PlainText  => $\"{consumerSecret}&{tokenSecret}\",\n            _          => throw new NotImplementedException(\"Only HMAC-SHA1, HMAC-SHA256, and RSA-SHA1 are currently supported.\")\n        };\n\n        var result = signatureTreatment == OAuthSignatureTreatment.Escaped\n            ? UrlEncodeRelaxed(signature)\n            : signature;\n\n        return result;\n\n        string GetRsaSignature() {\n            using var provider = new RSACryptoServiceProvider();\n            provider.PersistKeyInCsp = false;\n\n            provider.FromXmlString(unencodedConsumerSecret);\n\n#if NET\n            var hash = SHA1.HashData(Encoding.GetBytes(signatureBase));\n#else\n            var hasher = SHA1.Create();","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/restsharp/RestSharp/blob/6a5082169257438cd085f822f050d93256a8e499/src/RestSharp/Authenticators/OAuth/OAuthTools.cs#L214-L250","documentation":"Thrown by OAuthTools.GetSignature when the supplied signature method string is not one of the recognized constants (HMAC-SHA1, HMAC-SHA256, RSA-SHA1, PLAINTEXT). The switch's default arm fires a NotImplementedException. Note the message omits PLAINTEXT even though it is actually supported.","triggerScenarios":"Configuring an OAuth1Authenticator with SignatureMethod set to an unsupported value (e.g. 'HMAC-SHA512', 'SHA256', a typo, or a custom method). The value flows into GetSignature via the workflow.","commonSituations":"Typo in the signature method constant; using a newer hash algorithm the library does not support; copying an OAuth config from another library expecting broader algorithm support.","solutions":["Use one of the supported signature methods: OAuthTools.HmacSha1, HmacSha256, RsaSha1, or PlainText.","Check the exact casing and spelling of the signature method string passed to the authenticator.","For SHA-256 confirm you are using the HmacSha256 constant exactly as defined in OAuthTools."],"exampleFix":"// before\nauthenticator.SignatureMethod = \"HMAC-SHA512\";\n\n// after\nauthenticator.SignatureMethod = OAuthTools.HmacSha256;","handlingStrategy":"validation","validationCode":"var supported = new[] { \"HMAC-SHA1\", \"HMAC-SHA256\", \"RSA-SHA1\", \"PLAINTEXT\" };\nif (!supported.Contains(method)) throw new ArgumentOutOfRangeException(nameof(method), \"Unsupported signature method\");","typeGuard":"static bool IsSupportedSignatureMethod(string m) => m is \"HMAC-SHA1\" or \"HMAC-SHA256\" or \"RSA-SHA1\" or \"PLAINTEXT\";","tryCatchPattern":"try { authenticator.Authenticate(client, request, ct); } catch (NotImplementedException ex) when (ex.Message.Contains(\"currently supported\")) { /* switch to a supported signature method */ }","preventionTips":["Use the OAuthTools constants (HmacSha1, HmacSha256, RsaSha1, PlainText) rather than hand-typed strings.","Validate the signature method at configuration time."],"tags":["oauth","oauth1","signature","cryptography","authentication"],"backgroundTag":null,"analyzedSha":"6a5082169257438cd085f822f050d93256a8e499","analyzedAt":"2026-08-13T20:38:25.807Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}