(C#) Plaza API (bol.com) HMAC-SHA256 Authentication

Demonstrates how to compute the Authorization header for bol.com using HMAC-SHA256.

Chilkat .NET Downloads Chilkat .NET Framework Chilkat for .NET Core

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

Chilkat.Crypt2 crypt = new Chilkat.Crypt2();

crypt.EncodingMode = "base64";
crypt.HashAlgorithm = "sha256";
crypt.MacAlgorithm = "hmac";

string publicKey = "oRNWbHFXtAECmhnZmEndcjLIaSKbRMVE";
string privateKey = "MaQHPOnmYkPZNgeRziPnQyyOJYytUbcFBVJBvbMKoDdpPqaZbaOiLUTWzPAkpPsZFZbJHrcoltdgpZolyNcgvvBaKcmkqFjucFzXhDONTsPAtHHyccQlLUZpkOuywMiOycDWcCySFsgpDiyGnCWCZJkNTtVdPxbSUTWVIFQiUxaPDYDXRQAVVTbSVZArAZkaLDLOoOvPzxSdhnkkJWzlQDkqsXNKfAIgAldrmyfROSyCGMCfvzdQdUQEaYZTPEoA";

// The string to sign is this:
// http_verb +'\n\n'+ content_type +'\n'+ x_bol_date +'\n'+ 'x-bol-date:'+ x_bol_date +'\n'+ uri

string http_verb = "GET";
string content_type = "application/xml";
string x_bol_date = "Wed, 17 Feb 2016 00:00:00 GMT";
string uri = "/services/rest/orders/v2";

// IMPORTANT: Notice the use of underscore and hyphen (dash) chars in x-bol-date vs. x_bol_date.
// In one place hypens are used.  In two places, underscore chars are used.
Chilkat.StringBuilder sb = new Chilkat.StringBuilder();
sb.Append(http_verb);
sb.Append("\n\n");
sb.Append(content_type);
sb.Append("\n");
sb.Append(x_bol_date);
sb.Append("\nx-bol-date:");
sb.Append(x_bol_date);
sb.Append("\n");
sb.Append(uri);
Debug.WriteLine("[" + sb.GetAsString() + "]");

// Set the HMAC key:
crypt.SetMacKeyEncoded(privateKey,"ascii");
string mac = crypt.MacStringENC(sb.GetAsString());

// The answer should be: nqzLWvXI1eBhBXrRx5NF23V5hS8Q1xWCloJzPi/RAts=
Debug.WriteLine(mac);

// The last step is to append the public key with the signature
Chilkat.StringBuilder sbHeader = new Chilkat.StringBuilder();
sbHeader.Append(publicKey);
sbHeader.Append(":");
sbHeader.Append(mac);

string hdrValue = sbHeader.GetAsString();
Debug.WriteLine(hdrValue);