Styjun

I want be able to open attachments from my inbox via direct url. So I trying to generate Twitter OAuth header, respecting docs https://developer.twitter.com/en/docs/direct-messages/message-attachments/guides/retrieving-media.html, but response is always 401 Unathorized, and I don't know why.

I made all steps from documentation with full accuracy, double-checked. All should works, but it doesn't, and I have no idea why. Every response that I got from Twitter have http code 401. Tokens absolutely correct.

This is not a duplicate: I already checked similar questions, code from it doesn't works as well even if I copy-paste. I also can't use Abraham's Twitteroauth library because it have support only for API and OAuth endpoints, not for direct media links.

Here function that creates authorization header. You can see full code here: https://pastebin.com/yBEVW9KN

<?php

function getAuthorizationHeader(string $url)

 $params = array(
 "oauth_consumer_key" => $this->consumer_key,
 "oauth_nonce" => $this->getNonce(),
 "oauth_signature_method" => "HMAC-SHA1",
 "oauth_timestamp" => time(),
 "oauth_token" => $this->access_token,
 "oauth_version" => "1.0",
 );

 // Step 1. Percent encode.
 $_temp = [];
 foreach ($params as $key => $value) 
 $_temp[rawurlencode($key)] = rawurlencode($value);
 
 $params = $_temp;

 // Step 2. Sort.
 ksort($params);

 // Step 3. Build DST
 $dst = '';
 foreach ($params as $key => $value) 
 $dst .= $key . '=' . $value . '&';
 
 $dst = rtrim($dst, '&');

 // Step 4. Creating signature base string
 $baseString = 'GET' . '&' . rawurlencode($url) . '&' . rawurlencode($dst);

 // Step 5. Generating signature key
 $signingKey = rawurlencode($this->consumer_secret) . '&' . rawurlencode($this->access_token_secret);

 // Step 6. Finally, signature.
 $signature = base64_encode(hash_hmac('sha1', $baseString, $signingKey, true));

 // Step 7. Build header string.
 $header[] = 'authorization: ';
 $header[] = 'OAuth ';

 // Maybe ordering important as well?
 $header[] = 'oauth_consumer_key="' . $params['oauth_consumer_key'] . '",';
 $header[] = 'oauth_nonce="' . $params['oauth_nonce'] . '",';
 $header[] = 'oauth_signature="' . $signature . '",';
 $header[] = 'oauth_signature_method="' . $params['oauth_signature_method'] . '",';
 $header[] = 'oauth_timestamp="' . $params['oauth_timestamp'] . '",';
 $header[] = 'oauth_token="' . $params['oauth_token'] . '",';
 $header[] = 'oauth_version="' . $params['oauth_version'] . '"';

 return implode('', $header);