OAuth support for Clojure

clj-oauth provides OAuth client support for Clojure programs.

This maintained fork of drone29a/clj-oauth is published as net.clojars.savya/clj-oauth. It includes unreleased HMAC-SHA256 support. It uses current dependencies with security support: BouncyCastle jdk18on, clj-http 3.13, and Clojure 1.12.

Stack

Installing

deps.edn:

net.clojars.savya/clj-oauth {:mvn/version "1.7.0"}

Leiningen:

[net.clojars.savya/clj-oauth "1.7.0"]

Building

Build the jar:

clojure -T:build jar

Deploy to Clojars:

clojure -T:build deploy

Running tests

clojure -M:test

This runs deterministic unit tests without credentials or network access. Live Twitter tests have the ^:integration tag and do not run by default.

Client example

(require '[oauth.client :as oauth])

(def consumer
  (oauth/make-consumer <consumer-token>
                       <consumer-token-secret>
                       "https://api.twitter.com/oauth/request_token"
                       "https://api.twitter.com/oauth/access_token"
                       "https://api.twitter.com/oauth/authorize"
                       :hmac-sha1))

(def request-token (oauth/request-token consumer <callback-uri>))

(oauth/user-approval-uri consumer (:oauth_token request-token))

(def access-token-response
  (oauth/access-token consumer request-token <verifier>))

(def user-params {:status "posting from #clojure with #oauth"})
(def credentials
  (oauth/credentials consumer
                     (:oauth_token access-token-response)
                     (:oauth_token_secret access-token-response)
                     :POST
                     "https://api.twitter.com/1.1/statuses/update.json"
                     user-params))

(http/post "https://api.twitter.com/1.1/statuses/update.json"
           {:query-params (merge credentials user-params)})

Signed requests

For protected resources, signed-request generates the OAuth nonce and timestamp, signs the request, adds the Authorization header, and executes it through clj-http. Put additional OAuth fields in :oauth-params; all other options are passed through to clj-http. Query and form parameters are included in the signature.

(require '[oauth.client :as oauth])

(oauth/signed-request consumer
                      (:oauth_token access-token-response)
                      (:oauth_token_secret access-token-response)
                      :POST
                      "https://api.twitter.com/1.1/statuses/update.json"
                      {:form-params {:status "posting from #clojure"}
                       :headers {"X-Client" "example"}})

Convenience functions named get-request, post-request, put-request, and delete-request accept the same arguments without the method parameter.

Authors

Development funded by LikeStream LLC (Don Jackson and Shirish Andhare).

Designed and developed by Matt Revelle. Contributions from Richard Newman.

Savyasachi maintains this fork (2026). The original is: drone29a/clj-oauth.

License

Copyright © 2009 Matt Revelle.

Distributed under the BSD 2-Clause License. This preserves the original license.