Hi Terence, I believe the problem is that you are signing the OAuth request using verify_credentials.xml ($fakeurl = 'https://twitter.com/account/verify_credentials.xml). We need the request to be signed for https://api.twitter.com/1/account/verify_credentials.json. Try changing the value of $fakeurl and it should work.