The oauth_request module shouldn't need to know about the HMAC-SHA1 base string.

src/oauth_hmac.erl

@@ -1,15 +1,19 @@
 -module(oauth_hmac).
 
 -export([signature/3]).
+
+% for testing:
 -export([base_string/3]).
--export([normalize/1]). % for testing
+-export([normalize/1]).
 
 
+signature({Method, URL, Params}, ConsumerSecret, TokenSecret) ->
+  signature(base_string(Method, URL, Params), ConsumerSecret, TokenSecret);
 signature(BaseString, ConsumerSecret, TokenSecret) ->
   b64(crypto:sha_mac(key(ConsumerSecret, TokenSecret), BaseString)).
 
-base_string(MethodString, URL, Params) ->
-  string:join(lists:map(fun fmt:percent_encode/1, [MethodString, URL, normalize(Params)]), "&").
+base_string(Method, URL, Params) when is_list(Method) ->
+  string:join(lists:map(fun fmt:percent_encode/1, [Method, URL, normalize(Params)]), "&").
 
 normalize(Params) ->
   oauth_params:to_string(sort(Params)).

src/oauth_request.erl

@@ -51,8 +51,7 @@ signature(Method, URL, Params, Consumer, TokenSecret) ->
     "PLAINTEXT" ->
       oauth_plaintext:signature(ConsumerSecret, TokenSecret);
     "HMAC-SHA1" ->
-      BaseString = oauth_hmac:base_string(string:to_upper(atom_to_list(Method)), URL, Params),
-      oauth_hmac:signature(BaseString, ConsumerSecret, TokenSecret)
+      oauth_hmac:signature({string:to_upper(atom_to_list(Method)), URL, Params}, ConsumerSecret, TokenSecret)
   end.
 
 signature_method(Params) ->