the best advice is generally to use something that already implements oauth 1 to do your signature: https://oauth.net/1/