I haven't seen the action and controller being used when constructing the base string. Taking Guitarati's code sample above, after creating the signature object puts/log 'signature.signature_base_string' and compare this exactly against what you get in the oAuth tool. I've never seen the action/controller showing up in the base ...

Thanks for the code sample. I've been waiting for this callback so I can better track invites instead of just assuming the user actually sent the invite message. Everything appears to be working as described :)