Hi @Librerui thanks for reporting this, and sorry to hear you've been having this issue.

This Invalid signature error means that the QuickStatements’ generated OAuth credentials no longer match the OAuth consumer stored in Wikibase.

These credentials are generated only during initial WBS setup and are then stored in the persistent quickstatements-data volume. Recreating containers, pulling another image version, or reinstalling without removing volumes does not regenerate that file. In that situation an install can look fresh while QuickStatements is still using credentials generated for an earlier Wikibase database or consumer.

The following procedure are likely to get QuickStatements OAuth going again:

1) Regenerate the QuickStatements OAuth consumer using the command that matches your image version.

WBS 7.x through WBS 8.0.x:
This also updates the ElasticSearch / OpenSearch configuration and runs a full search reindex. It does not delete wiki content, uploads, or Docker volumes, but may take a while on a larger wiki.

docker compose exec wikibase bash /default-extra-install.sh

Wikibase 8.1.x and later:
This only regenerates the QuickStatements OAuth consumer and credentials.

docker compose exec wikibase \
  bash /var/www/html/extensions/WikibaseSuite/setup/scripts/setup-quickstatements-oauth.sh

2) Fully restart your services:
This stops and recreates containers but preserves all Docker volumes.

docker compose down
docker compose up -d

If this doesn't work please do share the command output back here taking care to remove OAuth consumer keys and secrets first (these commands can print them in their logs).

Please let us know how it goes.

Hi @lojo_wmde. Apologies for the late reply, I went a couple weeks without my computer and didn't have the opportunity to try your solutions, but I'm back now.

I can indeed confirm the solutions you showed do work for Wikibase 8.x!

However, my team has legacy systems running Wikibase 3 for the aforementioned project, hence why I mentioned that version in the post as well: Upgrading these to Wikibase 8 is proving to be tricky, so it would be good to have a solution that works for that version of Wikibase as well to apply in the meantime. I've tried simply deleting the quickstatements-data volume and restarting quickstatements in these instances, but that hasn't solved the problem. Is there anything else I could do, or should I put it off until I manage to update these installations?

Thank you for the help!

@lojo_wmde Ok, actually, I'm coming back with an update here.

So I did set up a Wikibase 8.1.x instance and test the proposed solution for that version, and it did work, however, I since managed to upgrade the aforementioned Wikibase 3 instances to 8.1.x, and now it isn't working.

This is the command's output:

+ '[' -z https://wikibase.tools.labs.wikimedia.pt/tools/quickstatements ']'
+ php /var/www/html/extensions/OAuth/maintenance/createOAuthConsumer.php --approve --callbackUrl https://wikibase.tools.labs.wikimedia.pt/tools/quickstatements/api.php --callbackIsPrefix true --user admin --name QuickStatements --description QuickStatements --version 1.0.1 --grants createeditmovepage --grants editpage --grants highvolume --jsonOnSuccess
A consumer with this name/version/publisher combination already exists
+ echo 'OAuth consumer creation failed, check errors above.'
OAuth consumer creation failed, check errors above.

It would appear that it isn't overwriting the previous, now broken OAuth consumer, and simply fails when it detects it's there. And, of course, as I mentioned previously, deleting the quickstatements-data volume also doesn't make a difference.

How might I solve this for these instances?

Thank you in advance!

@Librerui, thank you for getting back to us and giving good notes. It is good you were able to get successfully updated to WBS 8.1.

I'm realizing from the command output you shared that my earlier instruction assumed that the setup helper could replace an existing QuickStatements consumer when it doesn't. It only creates a consumer when no matching QuickStatements / 1.0.1 / admin registration exists.

So as you correctly noticed the existing consumer is still present in Wikibase, and deleting quickstatements-data simply removed QuickStatements’ local copy of its secret.

From where you are at now, do the following to correct this:

1. Log in to Wikibase as an admin user

2. Open the OAuth consumer page: https://wikibase.tools.labs.wikimedia.pt/wiki/Special:OAuthConsumerRegistration/list

3. In the list there find the existing QuickStatements consumer, version 1.0.1. Select manage on that entry.
   

4. Note your Consumer Key for later, and then towards the bottom of the form that appears tick Reset the secret key to a new value and click Update. Copy the new secret displayed in the resulting message, it won't be displayed again.
   
   

5. In the WBS directory on your server, create a temporary configuration file with an editor:

vi quickstatements-oauth.ini

Paste the following, replacing the placeholders with the values from the previous step:

; HTTP User-Agent header
agent = 'Wikibase Docker QuickStatements'
consumerKey = '<consumer key>'
consumerSecret = '<new consumer secret>'

6. Save the file, then copy it into the QuickStatements container and restart the service:

docker compose cp quickstatements-oauth.ini \
  quickstatements:/quickstatements/data/oauth.ini

docker compose restart quickstatements

7. For security, remove the temporary host file after the copy:

rm quickstatements-oauth.ini

I'm hoping that finally gets you going. Do let us know if it does or what else you run into.

Hi @lojo_wmde.

Updating the oauth.ini file directly like you suggested has partially solved the problem. It appears that the key and secret are being verified correctly now, however, I am still facing a different issue:

<br />
<b>Fatal error</b>:  Uncaught Exception: Error retrieving token1: {&amp;quot;error&amp;quot;:&amp;quot;mwoauth-callback-not-oob-or-prefix&amp;quot;,&amp;quot;message&amp;quot;:&amp;quot;oauth_callback must be set, and must be set to \&amp;quot;oob\&amp;quot; (case-sensitive), or the configured callback must be a prefix of the supplied callback.&amp;quot;,&amp;quot;callback&amp;quot;:&amp;quot;https:\/\/wikibase.tools.labs.wikimedia.pt\/tools\/quickstatements\/api.php&amp;quot;} in /var/www/html/magnustools/public_html/php/oauth.php:296
Stack trace:
#0 /var/www/html/quickstatements/public_html/api.php(123): MW_OAuth-&gt;doAuthorizationRedirect('https://wikibas...')
#1 {main}
  thrown in <b>/var/www/html/magnustools/public_html/php/oauth.php</b> on line <b>296</b><br />

It would appear that the callback URL of the OAuth consumer is also wrong, which, I checked, and did indeed verify so: The OAuth consumer's callback URL is set to "https://quickstatements.example/api.php", which is obviously incorrect. I'm unsure of how it got set to such a value, to be honest: My immediate belief is that it's due to mismanagement very long ago (I'm working with an instance that is well over a year old), but I can't be sure.

I'm now struggling to find a means to change this callback URL. I'm not finding any means to do so in the special pages, in fact none of the OAuth management tools allow you to edit much about the consumer at all, nor am I finding any way to just delete the consumer outright in order to create another with the setup-quickstatements-oauth.sh script from earlier.

Is there any way to update this value, or, failing that, to delete the consumer altogether?

Hi again @Librerui, this is good progress and we're close.

I’ve checked your public instance and can see the same callback failure clearly as well. Indeed the existing QuickStatements 1.0.1 OAuth consumer has a stale callback URL.

The following command should fix this once and for all.

1. This runs the normal QuickStatements OAuth setup script again, but temporarily changes its requested consumer version from 1.0.1 to 1.0.2 while it runs. This creates a new consumer using the current, correct callback URL along with writing its new key and secret to QuickStatements’ oauth.ini:

docker compose exec -T wikibase bash -ceu '
  sed "s/--version 1.0.1/--version 1.0.2/" \
    /var/www/html/extensions/WikibaseSuite/setup/scripts/setup-quickstatements-oauth.sh |
    bash
'

2. Restart QuickStatements:

docker compose restart quickstatements

The old 1.0.1 consumer remains registered but unused after this and can be revoked via the https://wikibase.tools.labs.wikimedia.pt/wiki/Special:OAuthConsumerRegistration/list page. The new 1.0.2 consumer should be the one QuickStatements uses going forward and you should be able to auth now.

Let us know how that goes! Fingers crossed.

Hello @lojo_wmde.

Yes, the solution you provided did indeed work for the instance in question. Thank you very much!

I'm reasonably sure that it will also work for the second instance, although I currently do not have access to it and it will take some time for me to regain it. I'll come back here in a few days with an update on that.

Thank you for the assistance!