restsharp/RestSharp · error · NotImplementedException

Only HMAC-SHA1, HMAC-SHA256, and RSA-SHA1 are currently supp

Error message

Only HMAC-SHA1, HMAC-SHA256, and RSA-SHA1 are currently supported.

What it means

Thrown by OAuthTools.GetSignature when the supplied signature method string is not one of the recognized constants (HMAC-SHA1, HMAC-SHA256, RSA-SHA1, PLAINTEXT). The switch's default arm fires a NotImplementedException. Note the message omits PLAINTEXT even though it is actually supported.

Source

Thrown at src/RestSharp/Authenticators/OAuth/OAuthTools.cs:232

        OAuthSignatureMethod    signatureMethod,
        OAuthSignatureTreatment signatureTreatment,
        string                  signatureBase,
        string?                 consumerSecret,
        string?                 tokenSecret = null
    ) {
        if (tokenSecret.IsEmpty()) tokenSecret       = string.Empty;
        if (consumerSecret.IsEmpty()) consumerSecret = string.Empty;

        var unencodedConsumerSecret = consumerSecret;
        consumerSecret = Uri.EscapeDataString(consumerSecret);
        tokenSecret    = Uri.EscapeDataString(tokenSecret);

        var signature = signatureMethod switch {
            HmacSha1   => GetHmacSignature(new HMACSHA1(), consumerSecret, tokenSecret, signatureBase),
            HmacSha256 => GetHmacSignature(new HMACSHA256(), consumerSecret, tokenSecret, signatureBase),
            RsaSha1    => GetRsaSignature(),
            PlainText  => $"{consumerSecret}&{tokenSecret}",
            _          => throw new NotImplementedException("Only HMAC-SHA1, HMAC-SHA256, and RSA-SHA1 are currently supported.")
        };

        var result = signatureTreatment == OAuthSignatureTreatment.Escaped
            ? UrlEncodeRelaxed(signature)
            : signature;

        return result;

        string GetRsaSignature() {
            using var provider = new RSACryptoServiceProvider();
            provider.PersistKeyInCsp = false;

            provider.FromXmlString(unencodedConsumerSecret);

#if NET
            var hash = SHA1.HashData(Encoding.GetBytes(signatureBase));
#else
            var hasher = SHA1.Create();

View on GitHub (pinned to 6a50821692)

Solutions

Use one of the supported signature methods: OAuthTools.HmacSha1, HmacSha256, RsaSha1, or PlainText.
Check the exact casing and spelling of the signature method string passed to the authenticator.
For SHA-256 confirm you are using the HmacSha256 constant exactly as defined in OAuthTools.

Example fix

// before
authenticator.SignatureMethod = "HMAC-SHA512";

// after
authenticator.SignatureMethod = OAuthTools.HmacSha256;

Defensive patterns

Strategy: validation

Validate before calling

var supported = new[] { "HMAC-SHA1", "HMAC-SHA256", "RSA-SHA1", "PLAINTEXT" };
if (!supported.Contains(method)) throw new ArgumentOutOfRangeException(nameof(method), "Unsupported signature method");

Type guard

static bool IsSupportedSignatureMethod(string m) => m is "HMAC-SHA1" or "HMAC-SHA256" or "RSA-SHA1" or "PLAINTEXT";

Try / catch

try { authenticator.Authenticate(client, request, ct); } catch (NotImplementedException ex) when (ex.Message.Contains("currently supported")) { /* switch to a supported signature method */ }

Prevention

Use the OAuthTools constants (HmacSha1, HmacSha256, RsaSha1, PlainText) rather than hand-typed strings.
Validate the signature method at configuration time.

When it happens

Trigger: Configuring an OAuth1Authenticator with SignatureMethod set to an unsupported value (e.g. 'HMAC-SHA512', 'SHA256', a typo, or a custom method). The value flows into GetSignature via the workflow.

Common situations: Typo in the signature method constant; using a newer hash algorithm the library does not support; copying an OAuth config from another library expecting broader algorithm support.

Related errors

AI-assisted analysis of restsharp/RestSharp@6a50821692 (2026-08-13). Data as JSON: /api/errors/027ff7bac66d207d. Report an issue: GitHub.