I'd add, that if you are implementing OAuth 1, you are making life painful for developers. If you are creating an API now, please use OAuth 2. It's much more straightforward for both server and client.