The scope field is a space delimited list.
The +
character is commonly used as a shortcut for space, since it's more readable than %20
(which is what space encodes to).
If using a plus character results in an encoded plus (%2B) being sent, then you are left with two other ways of putting the space into the URL:
- using a literal space character, or
- using an encoded space
%20
Try both of those options, ideally using a network snifer (e.g. WireShark) so that you can see accurately what is being sent.
Update: As per comments below, %20
is correct, but the signature based string needs to be encoded again, so for that the %
becomes %25
, giving a result of %2520
.