Lua Requires Chilkat v11.0.0+

ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request. Lua

local chilkat = require("chilkat")

-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

-- Note: Ebay provides a Key Management API
-- See https://developer.ebay.com/api-docs/developer/key-management/overview.html

-- The following test keys can be used:
--
-- Ed25519
--
-- Private Key:
--
-- -----BEGIN PRIVATE KEY-----
-- MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
-- -----END PRIVATE KEY-----

local strPrivateKey = "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF"

-- Public Key:
--
-- -----BEGIN PUBLIC KEY-----
-- MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
-- -----END PUBLIC KEY-----

local strPublicKey = "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs="

-- This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
-- This JWE is just for example:
local strJwe = "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw"

local sbBody = chilkat.StringBuilder.new()
sbBody:append("{\"hello\": \"world\"}")

print("Body of request:")
print(sbBody:get_as_string())

-- -------------------------------------------------
-- Build the signature base string...

local sbSigBase = chilkat.StringBuilder.new()

sbSigBase:append("\"content-digest\": sha-256=:")
sbSigBase:append(sbBody:get_hash("sha256", "base64", "utf-8"))
sbSigBase:append(":\n")

sbSigBase:append("\"x-ebay-signature-key\": ")
sbSigBase:append(strJwe)
sbSigBase:append("\n")

sbSigBase:append("\"@method\": POST\n")

-- This is the path part of the URL without query params...
sbSigBase:append("\"@path\": ")
sbSigBase:append("/verifysignature")
sbSigBase:append("\n")

-- The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
-- In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
-- Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
sbSigBase:append("\"@authority\": ")
sbSigBase:append("localhost:8080")
sbSigBase:append("\n")

sbSigBase:append("\"@signature-params\": ")

local sbSigInput = chilkat.StringBuilder.new()
sbSigInput:append("(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")")
sbSigInput:append(";created=")

local dt = chilkat.DateTime.new()
dt:set_from_current_system_time()
local unixTimeNow = dt:get_as_unix_time_str(false)
sbSigInput:append(unixTimeNow)

sbSigBase:append_sb(sbSigInput)

-- -------------------------------------------------
-- Sign the signature base string using the Ed25519 private key

local bdPrivKey = chilkat.BinData.new()
bdPrivKey:append_encoded(strPrivateKey, "base64")

local privKey = chilkat.PrivateKey.new()
local success = privKey:load_any_format(bdPrivKey, "")
if not success then
    print(privKey.last_error_text)
    return
end

local bdToBeSigned = chilkat.BinData.new()
bdToBeSigned:append_sb(sbSigBase, "utf-8")

local eddsa = chilkat.EdDSA.new()
local sigBase64 = eddsa:sign_bd_enc(bdToBeSigned, "base64", privKey)
if not eddsa.last_method_success then
    print(eddsa.last_error_text)
    return
end

print("sigBase64:")
print(sigBase64)

-- ----------------------------------------------------------
-- Send the JSON POST

local http = chilkat.Http.new()

http:set_request_header("x-ebay-signature-key", strJwe)

local sbContentDigestHdr = chilkat.StringBuilder.new()
sbContentDigestHdr:append("sha-256=:")
sbContentDigestHdr:append(sbBody:get_hash("sha256", "base64", "utf-8"))
sbContentDigestHdr:append(":")
http:set_request_header("Content-Digest", sbContentDigestHdr:get_as_string())

local sbSigHdr = chilkat.StringBuilder.new()
sbSigHdr:append("sig1=:")
sbSigHdr:append(sigBase64)
sbSigHdr:append(":")
http:set_request_header("Signature", sbSigHdr:get_as_string())

sbSigInput:prepend("sig1=")
http:set_request_header("Signature-Input", sbSigInput:get_as_string())

-- Add this header to make eBay actually check the signature.
http:set_request_header("x-ebay-enforce-signature", "true")

-- Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
http.auth_token = "your_oauth2_access_token"

-- The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
-- Normally, you'll send your POST to some api.ebay.com endpoint.
local url = "http://localhost:8080/verifysignature"

local jsonStr = sbBody:get_as_string()
local resp = chilkat.HttpResponse.new()
success = http:http_str("POST", "http://localhost:8080/verifysignature", jsonStr, "utf-8", "application/json", resp)
if not success then
    print(http.last_error_text)
    return
end

print("Response status code: " .. resp.status_code)
print("Response body:")
print(resp.body_str)