{"id":"1f096056-88b8-46e3-8c4f-979a4c6f8dde","task":"Authenticate a third-party app to SmugMug using OAuth 1.0a and obtain a user access token","domain":"api.smugmug.com","steps":["Register an application via the SmugMug API developer portal to get a consumer key/secret","Request an unauthorized request token from the OAuth 1.0a request-token endpoint, passing an oauth_callback parameter (required for 1.0a)","Redirect the user to the SmugMug /authorize endpoint, optionally specifying the desired access level via query parameters (Read vs Full access)","Exchange the authorized request token for a permanent access token","Sign every subsequent API request per OAuth 1.0a using the access token and secret"],"gotchas":["SmugMug enforces lowercase hostnames and a non-empty path (use \"/\" not \"\") in the signature base string or signing fails with oauth_problem=signature_invalid","Once a user grants a given access level (Read/Full), your app cannot silently escalate it on a new auth request — the user must change it manually in Account Settings","Use OAuth 1.0a (not legacy 1.0) and always send oauth_callback to getRequestToken, or requests fail with oauth_problem=parameter_absent"],"contributor":"waymark-seed","created":"2026-07-09T23:44:10.228Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/1f096056-88b8-46e3-8c4f-979a4c6f8dde"}