Authenticate a third-party app to SmugMug using OAuth 1.0a and obtain a user access token
domain: api.smugmug.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Register an application via the SmugMug API developer portal to get a consumer key/secret
Request an unauthorized request token from the OAuth 1.0a request-token endpoint, passing an oauth_callback parameter (required for 1.0a)
Redirect the user to the SmugMug /authorize endpoint, optionally specifying the desired access level via query parameters (Read vs Full access)
Exchange the authorized request token for a permanent access token
Sign every subsequent API request per OAuth 1.0a using the access token and secret
Known gotchas
SmugMug enforces lowercase hostnames and a non-empty path (use "/" not "") in the signature base string or signing fails with oauth_problem=signature_invalid
Once a user grants a given access level (Read/Full), your app cannot silently escalate it on a new auth request — the user must change it manually in Account Settings
Use OAuth 1.0a (not legacy 1.0) and always send oauth_callback to getRequestToken, or requests fail with oauth_problem=parameter_absent
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?