usebruno/bruno · error · Error

Unsupported OAuth1 signature method: ${method}

Error message

Unsupported OAuth1 signature method: ${method}

What it means

Thrown by the OAuth1 signer's defaultHashFunction switch when `method` does not match any known case (PLAINTEXT, RSA-SHA1/256/512, HMAC-SHA1/256/512). The default branch rejects unknown values so an unsupported algorithm cannot silently produce a weak or invalid signature.

Source

Thrown at packages/bruno-requests/src/auth/oauth1-request-authorization.ts:208

        'RSA-SHA256': 'RSA-SHA256',
        'RSA-SHA512': 'RSA-SHA512'
      };
      const signer = crypto.createSign(algoMap[method]);
      signer.update(baseString);
      return signer.sign(privateKey, 'base64');
    }

    case 'HMAC-SHA512':
      return crypto.createHmac('sha512', key).update(baseString).digest('base64');

    case 'HMAC-SHA256':
      return crypto.createHmac('sha256', key).update(baseString).digest('base64');

    case 'HMAC-SHA1':
      return crypto.createHmac('sha1', key).update(baseString).digest('base64');

    default:
      throw new Error(`Unsupported OAuth1 signature method: ${method}`);
  }
}

// Body Hash (draft-eaton-oauth-bodyhash-00)
// https://datatracker.ietf.org/doc/id/draft-eaton-oauth-bodyhash-00.html
export function computeBodyHash(body: string, signatureMethod: SignatureMethod): string {
  const algoMap: Record<string, string> = {
    'HMAC-SHA512': 'sha512',
    'HMAC-SHA256': 'sha256',
    'RSA-SHA512': 'sha512',
    'RSA-SHA256': 'sha256'
  };
  const algo = algoMap[signatureMethod] || 'sha1';
  return crypto.createHash(algo).update(body).digest('base64');
}

/**
 * OAuth 1.0 authorization library (RFC 5849).

View on GitHub (pinned to 9bdd81c7bd)

Solutions

1. Use one of the supported values exactly: PLAINTEXT, HMAC-SHA1, HMAC-SHA256, HMAC-SHA512, RSA-SHA1, RSA-SHA256, RSA-SHA512.
2. Trim whitespace and verify casing before passing the value.
3. If you need a method not listed, fall back to HMAC-SHA1 (the OAuth1 default) or extend the signer deliberately.

Example fix

// before
const authorizer = createOAuth1Authorizer({
  consumer: { key, secret },
  signature_method: 'RS256' // JWT alg name, not OAuth1
});

// after
const authorizer = createOAuth1Authorizer({
  consumer: { key, secret },
  signature_method: 'RSA-SHA256'
});

const SUPPORTED = new Set(['PLAINTEXT','HMAC-SHA1','HMAC-SHA256','HMAC-SHA512','RSA-SHA1','RSA-SHA256','RSA-SHA512']);
function assertMethod(m) {
  if (!SUPPORTED.has(String(m).trim())) throw new Error('unsupported signature method: ' + m);
}

const isSupportedMethod = (m) => typeof m === 'string' && SUPPORTED.has(m.trim());

try { authorizer.authorize(req); }
catch (err) {
  if (/Unsupported OAuth1 signature method/.test(err.message)) {
    config.signature_method = 'HMAC-SHA1'; // safe default
  } else throw err;
}

When it happens

Trigger: Configuring signature_method with a typo or unsupported value such as 'HMAC-MD5', 'RS256', 'rsa-sha256' (wrong casing), 'HMAC-SHA384', or undefined.

Common situations: Copy-pasted a JWT alg name (RS256, HS256) into the OAuth1 config; casing mismatch (the switch is case-sensitive); trailing whitespace in the value; an old collection carrying a now-retired method.

Related errors

• Private key is required for ${method} signature method
• EdgeGrid: accessToken is required
• EdgeGrid: clientToken is required
• EdgeGrid: clientSecret is required
• Invalid token URL: ${requestConfig.url}

AI-assisted analysis of usebruno/bruno@9bdd81c7bd (2026-08-13). Data as JSON: /api/errors/6bd767dcd4a010cf. Report an issue: GitHub.