Spaces will become either + or %20 after you encode the query string values to generate the final authentication URL.
+
%20