(Delphi DLL) Plaza API (bol.com) HMAC-SHA256 Authentication

Demonstrates how to compute the Authorization header for bol.com using HMAC-SHA256.

Chilkat for Delphi Downloads Chilkat non-ActiveX DLL for Delphi Chilkat ActiveX DLL for Delphi * The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Crypt2, StringBuilder;

...

procedure TForm1.Button1Click(Sender: TObject);
var
crypt: HCkCrypt2;
publicKey: PWideChar;
privateKey: PWideChar;
http_verb: PWideChar;
content_type: PWideChar;
x_bol_date: PWideChar;
uri: PWideChar;
sb: HCkStringBuilder;
mac: PWideChar;
sbHeader: HCkStringBuilder;
hdrValue: PWideChar;

begin
// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

crypt := CkCrypt2_Create();

CkCrypt2_putEncodingMode(crypt,'base64');
CkCrypt2_putHashAlgorithm(crypt,'sha256');
CkCrypt2_putMacAlgorithm(crypt,'hmac');

publicKey := 'oRNWbHFXtAECmhnZmEndcjLIaSKbRMVE';
privateKey := 'MaQHPOnmYkPZNgeRziPnQyyOJYytUbcFBVJBvbMKoDdpPqaZbaOiLUTWzPAkpPsZFZbJHrcoltdgpZolyNcgvvBaKcmkqFjucFzXhDONTsPAtHHyccQlLUZpkOuywMiOycDWcCySFsgpDiyGnCWCZJkNTtVdPxbSUTWVIFQiUxaPDYDXRQAVVTbSVZArAZkaLDLOoOvPzxSdhnkkJWzlQDkqsXNKfAIgAldrmyfROSyCGMCfvzdQdUQEaYZTPEoA';

// The string to sign is this:
// http_verb +'\n\n'+ content_type +'\n'+ x_bol_date +'\n'+ 'x-bol-date:'+ x_bol_date +'\n'+ uri

http_verb := 'GET';
content_type := 'application/xml';
x_bol_date := 'Wed, 17 Feb 2016 00:00:00 GMT';
uri := '/services/rest/orders/v2';

// IMPORTANT: Notice the use of underscore and hyphen (dash) chars in x-bol-date vs. x_bol_date.
// In one place hypens are used.  In two places, underscore chars are used.
sb := CkStringBuilder_Create();
CkStringBuilder_Append(sb,http_verb);
CkStringBuilder_Append(sb,#10 + #10);
CkStringBuilder_Append(sb,content_type);
CkStringBuilder_Append(sb,#10);
CkStringBuilder_Append(sb,x_bol_date);
CkStringBuilder_Append(sb,#10 + 'x-bol-date:');
CkStringBuilder_Append(sb,x_bol_date);
CkStringBuilder_Append(sb,#10);
CkStringBuilder_Append(sb,uri);
Memo1.Lines.Add('[' + CkStringBuilder__getAsString(sb) + ']');

// Set the HMAC key:
CkCrypt2_SetMacKeyEncoded(crypt,privateKey,'ascii');
mac := CkCrypt2__macStringENC(crypt,CkStringBuilder__getAsString(sb));

// The answer should be: nqzLWvXI1eBhBXrRx5NF23V5hS8Q1xWCloJzPi/RAts=
Memo1.Lines.Add(mac);

// The last step is to append the public key with the signature
sbHeader := CkStringBuilder_Create();
CkStringBuilder_Append(sbHeader,publicKey);
CkStringBuilder_Append(sbHeader,':');
CkStringBuilder_Append(sbHeader,mac);

hdrValue := CkStringBuilder__getAsString(sbHeader);
Memo1.Lines.Add(hdrValue);

CkCrypt2_Dispose(crypt);
CkStringBuilder_Dispose(sb);
CkStringBuilder_Dispose(sbHeader);

end;