the signature should be generated using a SHA hash with a base string ( account + "&" + consumerKey + "&" + token + "&" + nonce + "&" + timestamp ) and a key ( consumerSecret + "&" + tokenSecret )