Sign an OAuth 1.0a request in plain Node

import { createHmac, randomBytes } from "node:crypto";
 
// Stricter than encodeURIComponent: OAuth also escapes ! * ' ( )
function pctEncode(value: string): string {
  return encodeURIComponent(value).replace(
    /[!*'()]/g,
    (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase(),
  );
}
 
interface Creds {
  consumerKey: string;
  consumerSecret: string;
  token: string;
  tokenSecret: string;
}
 
export function authHeader(
  method: string,
  baseUrl: string,
  creds: Creds,
): string {
  const oauth: Record<string, string> = {
    oauth_consumer_key: creds.consumerKey,
    oauth_nonce: randomBytes(16).toString("hex"),
    oauth_signature_method: "HMAC-SHA1",
    oauth_timestamp: Math.floor(Date.now() / 1000).toString(),
    oauth_token: creds.token,
    oauth_version: "1.0",
  };
 
  // Sort by encoded key, then join as k=v with &.
  const sortedEncodedParams = Object.keys(oauth)
    .map((k) => [pctEncode(k), pctEncode(oauth[k])])
    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
    .map(([k, v]) => `${k}=${v}`)
    .join("&");
 
  const baseString =
    method.toUpperCase() +
    "&" +
    pctEncode(baseUrl) +
    "&" +
    pctEncode(sortedEncodedParams);
 
  const signingKey =
    pctEncode(creds.consumerSecret) + "&" + pctEncode(creds.tokenSecret);
 
  oauth.oauth_signature = createHmac("sha1", signingKey)
    .update(baseString)
    .digest("base64");
 
  return (
    "OAuth " +
    Object.keys(oauth)
      .sort()
      .map((k) => `${pctEncode(k)}="${pctEncode(oauth[k])}"`)
      .join(", ")
  );
}