I am using MediaWiki 1.28.0.

I want to provision new users (create new accounts) in MediaWiki using the API. The provisioning will be driven by a callout from another service (a registry that enrolls and manages users in a project using the wiki). Users do not participate directly in the provisioning.

I have set up my client as an OAuth Owner-only consumer as detailed at


I am able to request an account creation token using this code:

$oauth = new OAuth( $consumerKey, $consumerSecret, OAUTH_SIG_METHOD_HMACSHA1,OAUTH_AUTH_TYPE_AUTHORIZATION );
$oauth->setToken( $accessToken, $accessSecret );

$oauth->fetch('https://myserver/w/api.php?action=query&meta=tokens&type=createaccount&format=json', null, OAUTH_HTTP_METHOD_PUT);

$response = json_decode($oauth->getLastResponse(), true);

When I execute that code the $response is, for example,

    [batchcomplete] => 
    [query] => Array
            [tokens] => Array
                    [createaccounttoken] => 8f9c1c7c2b38918cb5caac5c87dd2084585bf6c3+\



Note the end of the token include +\

First question: Is that form of the token, specifically having +\ at the end, correct and expected?

If I then take that token and execute

$createAccountToken = $response['query']['tokens']['createaccounttoken'];

$oauth->fetch("https://myserver/w/api.php?action=createaccount&format=json&name=FooBar&email=foobar@gmail.com&realname=FooBar&mailpassword=false&reason=provisioning&language=en&token=$createAccountToken", null, OAUTH_HTTP_METHOD_PUT);

I receive

{"error":{"code":"createnotoken","info":"The token parameter must be set","*":"See https://myserver/w/api.php for API usage"}}

Second question: What am I doing wrong when invoking the createaccount action?

I am following documentation at


but it is not clear to me which parts of that page may be deprecated and precisely how I should provision a new account.

I appreciate any insights.


Scott K