Swift

ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request. Swift

func chilkatTest() {
    var success: Bool = false

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Ebay provides a Key Management API
    // See https://developer.ebay.com/api-docs/developer/key-management/overview.html

    // The following test keys can be used: 
    // 
    // Ed25519 
    // 
    // Private Key:
    // 
    // -----BEGIN PRIVATE KEY-----
    // MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
    // -----END PRIVATE KEY-----

    var strPrivateKey: String? = "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF"

    // 
    // Public Key:
    // 
    // -----BEGIN PUBLIC KEY-----
    // MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
    // -----END PUBLIC KEY-----

    var strPublicKey: String? = "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs="

    // This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
    // This JWE is just for example:
    var strJwe: String? = "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw"

    let sbBody = CkoStringBuilder()!
    sbBody.append(value: "{\"hello\": \"world\"}")

    print("Body of request:")
    print("\(sbBody.getAsString()!)")

    // -------------------------------------------------
    // Build the signature base string...

    let sbSigBase = CkoStringBuilder()!

    sbSigBase.append(value: "\"content-digest\": sha-256=:")
    sbSigBase.append(value: sbBody.getHash(algorithm: "sha256", encoding: "base64", charset: "utf-8"))
    sbSigBase.append(value: ":\n")

    sbSigBase.append(value: "\"x-ebay-signature-key\": ")
    sbSigBase.append(value: strJwe)
    sbSigBase.append(value: "\n")

    sbSigBase.append(value: "\"@method\": POST\n")

    // This is the path part of the URL without query params...
    sbSigBase.append(value: "\"@path\": ")
    sbSigBase.append(value: "/verifysignature")
    sbSigBase.append(value: "\n")

    // The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
    // In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
    // Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
    sbSigBase.append(value: "\"@authority\": ")
    sbSigBase.append(value: "localhost:8080")
    sbSigBase.append(value: "\n")

    sbSigBase.append(value: "\"@signature-params\": ")

    let sbSigInput = CkoStringBuilder()!
    sbSigInput.append(value: "(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")")
    sbSigInput.append(value: ";created=")

    let dt = CkoDateTime()!
    dt.setFromCurrentSystemTime()
    var unixTimeNow: String? = dt.get(asUnixTimeStr: false)
    sbSigInput.append(value: unixTimeNow)

    sbSigBase.appendSb(sb: sbSigInput)

    // -------------------------------------------------
    // Sign the signature base string using the Ed25519 private key

    let bdPrivKey = CkoBinData()!
    bdPrivKey.appendEncoded(encData: strPrivateKey, encoding: "base64")

    let privKey = CkoPrivateKey()!
    success = privKey.loadAnyFormat(privKeyData: bdPrivKey, password: "")
    if success == false {
        print("\(privKey.lastErrorText!)")
        return
    }

    let bdToBeSigned = CkoBinData()!
    bdToBeSigned.appendSb(sb: sbSigBase, charset: "utf-8")

    let eddsa = CkoEdDSA()!
    var sigBase64: String? = eddsa.signBdENC(bd: bdToBeSigned, encoding: "base64", privkey: privKey)
    if eddsa.lastMethodSuccess == false {
        print("\(eddsa.lastErrorText!)")
        return
    }

    print("sigBase64:")
    print("\(sigBase64!)")

    // ----------------------------------------------------------
    // Send the JSON POST

    let http = CkoHttp()!

    http.setRequestHeader(name: "x-ebay-signature-key", value: strJwe)

    let sbContentDigestHdr = CkoStringBuilder()!
    sbContentDigestHdr.append(value: "sha-256=:")
    sbContentDigestHdr.append(value: sbBody.getHash(algorithm: "sha256", encoding: "base64", charset: "utf-8"))
    sbContentDigestHdr.append(value: ":")
    http.setRequestHeader(name: "Content-Digest", value: sbContentDigestHdr.getAsString())

    let sbSigHdr = CkoStringBuilder()!
    sbSigHdr.append(value: "sig1=:")
    sbSigHdr.append(value: sigBase64)
    sbSigHdr.append(value: ":")
    http.setRequestHeader(name: "Signature", value: sbSigHdr.getAsString())

    sbSigInput.prepend(value: "sig1=")
    http.setRequestHeader(name: "Signature-Input", value: sbSigInput.getAsString())

    // Add this header to make eBay actually check the signature.
    http.setRequestHeader(name: "x-ebay-enforce-signature", value: "true")

    // Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
    http.authToken = "your_oauth2_access_token"

    // The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
    // Normally, you'll send your POST to some api.ebay.com endpoint.
    var url: String? = "http://localhost:8080/verifysignature"

    var jsonStr: String? = sbBody.getAsString()
    let resp = CkoHttpResponse()!
    success = http.httpStr(verb: "POST", url: "http://localhost:8080/verifysignature", bodyStr: jsonStr, charset: "utf-8", contentType: "application/json", response: resp)
    if success == false {
        print("\(http.lastErrorText!)")
        return
    }

    print("Response status code: \(resp.statusCode.intValue)")
    print("Response body:")
    print("\(resp.bodyStr!)")

}