OAuth support for Clojure

clj-oauth provides OAuth client support for Clojure programs.

This maintained fork of drone29a/clj-oauth is published as net.clojars.savya/clj-oauth. It includes unreleased HMAC-SHA256 support. It uses current dependencies with security support: BouncyCastle jdk18on, clj-http 3.13, and Clojure 1.12.

Stack

Installing

deps.edn:

net.clojars.savya/clj-oauth {:mvn/version "1.8.0"}

Leiningen:

[net.clojars.savya/clj-oauth "1.8.0"]

Building

Build the jar:

clojure -T:build jar

Deploy to Clojars:

clojure -T:build deploy

Running tests

clojure -M:test

This runs deterministic unit tests without credentials or network access. Live Twitter tests have the ^:integration tag and do not run by default.

Client example

(require '[oauth.client :as oauth])

(def consumer
  (oauth/make-consumer <consumer-token>
                       <consumer-token-secret>
                       "https://api.twitter.com/oauth/request_token"
                       "https://api.twitter.com/oauth/access_token"
                       "https://api.twitter.com/oauth/authorize"
                       :hmac-sha1))

;; The signature method may be :hmac-sha1 (the default), :hmac-sha256,
;; :rsa-sha1, :rsa-sha256, or :plaintext. RSA private keys may be given in
;; either PKCS#1 or PKCS#8 PEM format.

;; A callback URI is not required for desktop applications.
(def request-token (oauth/request-token consumer <callback-uri>))

(oauth/user-approval-uri consumer (:oauth_token request-token))

(def access-token-response
  (oauth/access-token consumer request-token <verifier>))

(def user-params {:status "posting from #clojure with #oauth"})
(def credentials
  (oauth/credentials consumer
                     (:oauth_token access-token-response)
                     (:oauth_token_secret access-token-response)
                     :POST
                     "https://api.twitter.com/1.1/statuses/update.json"
                     user-params))

(http/post "https://api.twitter.com/1.1/statuses/update.json"
           {:query-params (merge credentials user-params)})

Signed requests

For protected resources, signed-request generates the OAuth nonce and timestamp, signs the request, adds the Authorization header, and executes it through clj-http. Put additional OAuth fields in :oauth-params; all other options are passed through to clj-http. Query and form parameters are included in the signature.

Parameter maps remain supported. Query, form, and additional OAuth parameters may also be supplied as ordered key-value pairs, for example [["tag" "clojure"] ["tag" "oauth"]]; repeated keys are retained for RFC 5849 signature normalization.

(require '[oauth.client :as oauth])

(oauth/signed-request consumer
                      (:oauth_token access-token-response)
                      (:oauth_token_secret access-token-response)
                      :POST
                      "https://api.twitter.com/1.1/statuses/update.json"
                      {:form-params {:status "posting from #clojure"}
                       :headers {"X-Client" "example"}})

Convenience functions named get-request, post-request, put-request, and delete-request accept the same arguments without the method parameter.

Authors

Development funded by LikeStream LLC (Don Jackson and Shirish Andhare), see likestream.org/opensource.html.

Designed and developed by Matt Revelle. Contributions from Richard Newman.

Savyasachi maintains this fork (2026). The original is: drone29a/clj-oauth.

License

Copyright © 2009 Matt Revelle.

Distributed under the BSD 2-Clause License. This preserves the original license.