"The authorization headers in your request are not valid: Invalid signature"

I did see the breaking change at

but I am not using lgpassword or lgtoken here.

Did something else change? I notice I have

'oauth_signature_method' => 'HMAC-SHA1'

Did someone perhaps change that after the SHA1 foobar?

Anything else it could be? I know I haven't fiddled with my code...