Hello,

I am using MediaWiki 1.28.0.

I want to provision new users (create new accounts) in MediaWiki using the API. The provisioning will be driven by a callout from another service (a registry that enrolls and manages users in a project using the wiki). Users do not participate directly in the provisioning.

I have set up my client as an OAuth Owner-only consumer as detailed at

https://www.mediawiki.org/wiki/OAuth/Owner-only_consumers

I am able to request an account creation token using this code:

$oauth = new OAuth( $consumerKey, $consumerSecret, OAUTH_SIG_METHOD_HMACSHA1,OAUTH_AUTH_TYPE_AUTHORIZATION );
$oauth->setToken( $accessToken, $accessSecret );

$oauth->fetch('https://myserver/w/api.php?action=query&meta=tokens&type=createaccount&format=json', null, OAUTH_HTTP_METHOD_PUT);

$response = json_decode($oauth->getLastResponse(), true);

When I execute that code the $response is, for example,

Array
(
    [batchcomplete] => 
    [query] => Array
        (
            [tokens] => Array
                (
                    [createaccounttoken] => 8f9c1c7c2b38918cb5caac5c87dd2084585bf6c3+\
                )

        )

)

Note the end of the token include +\

First question: Is that form of the token, specifically having +\ at the end, correct and expected?

If I then take that token and execute

$createAccountToken = $response['query']['tokens']['createaccounttoken'];

$oauth->fetch("https://myserver/w/api.php?action=createaccount&format=json&name=FooBar&email=foobar@gmail.com&realname=FooBar&mailpassword=false&reason=provisioning&language=en&token=$createAccountToken", null, OAUTH_HTTP_METHOD_PUT);

I receive

{"error":{"code":"createnotoken","info":"The token parameter must be set","*":"See https://myserver/w/api.php for API usage"}}

Second question: What am I doing wrong when invoking the createaccount action?

I am following documentation at

https://www.mediawiki.org/wiki/API:Account_creation

but it is not clear to me which parts of that page may be deprecated and precisely how I should provision a new account.

I appreciate any insights.

Thanks,

Scott K