OAuth multipart post in Erlang - twitter

Question

I am trying to extend this library https://github.com/tim/erlang-oauth-examples to allow the client to make multipart posts (as necessary for Twitter's statuses/update_with_media). So far the, this is my attempt at the extra final signing and authentication logic that is necessary. The formation of the Body, using Boundaries is done elsewhere, and I don't think is the stumbling block.
oauth_post({multipart, Boundary}, URL, Body, Consumer, Token, TokenSecret) ->
BodyH = base64:encode_to_string(crypto:hash(sha, Body)),
Signed = oauth:sign("POST", URL, [{"oauth_body_hash", BodyH}], Consumer, Token, TokenSecret),
{[[{ "oauth_signature", Sig}],
[{"oauth_body_hash", BBody}]], Rest} =
proplists:split(Signed, ["oauth_signature", "oauth_body_hash"]),
Encoded = [ {"oauth_signature", oauth:uri_encode(Sig)}
, {"oauth_body_hash", oauth:uri_encode(BBody)}
| Rest],
Sorted = lists:sort(Encoded),
Auth = lists:flatten(string:join([ K++"=\""++V++"\"" || {K,V} <- Sorted], ", ")),
OAuth = "OAuth " ++ Auth,
ContentType = "multipart/form-data;boundary=" ++ Boundary,
Headers = [ {"Authorization", OAuth}
, {"Content-Type", ContentType}
, {"Content-Length", integer_to_list(length(Body))}],
Request = {URL, Headers, ContentType, Body},
httpc:request(post, Request, [], []).
But so far this method call fails to Authenticate. Can anyone, with this domain expertise, see what I'm doing wrong? Many thanks.
After Answer
Per Paul's answer below, this is what I ended up using. Updated my fork of the library too.
oauth_post({multipart, Boundary}, URL, Body, Consumer, Token, TokenSecret) ->
BodyH = base64:encode_to_string(crypto:hash(sha, Body)),
Signed = oauth:sign("POST", URL, [{"oauth_body_hash", BodyH}]
, Consumer, Token, TokenSecret),
{AuthorizationParams, []} =
lists:partition(fun({K, _}) -> lists:prefix("oauth_", K) end, Signed),
Headers = [ oauth:header(AuthorizationParams)],
ContentType = "multipart/form-data;boundary=" ++ Boundary,
Request = {URL, Headers, ContentType, Body},
httpc:request(post, Request, [], []).

Answer 1

The issue is that your code only URI-encodes the signature and the body hash. All oauth_* parameters must be URI-encoded, and especially oauth_nonce which is a Base64 string in this OAuth library.
Nonce = base64:encode_to_string(crypto:rand_bytes(32)), % cf. ruby-oauth
As a side note:
Fetching the value for key "oauth_body_hash" does not make sense since you passed this value in the first place (it is in BodyH).
You don't need to sort the oauth_ parameters in the signature.
You don't need the Content-Type and Content-Length headers, inets' httpc will add them for you unless you pass headers_as_is option.
Simply do:
oauth_post({multipart, Boundary}, URL, Body, Consumer, Token, TokenSecret) ->
BodyH = base64:encode_to_string(crypto:hash(sha, Body)),
Signed = oauth:sign("POST", URL, [{"oauth_body_hash", BodyH}], Consumer, Token, TokenSecret),
% URI encode values returned by oauth:sign/6 for the Authorization header
Auth = lists:flatten(string:join([ K++"=\""++oauth:uri_encode(V)++"\"" || {K,V} <- Signed], ", ")),
OAuth = "OAuth " ++ Auth,
ContentType = "multipart/form-data;boundary=" ++ Boundary,
Headers = [ {"Authorization", OAuth} ],
Request = {URL, Headers, ContentType, Body},
httpc:request(post, Request, [], []).