(AutoIt) Plaza API (bol.com) HMAC-SHA256 Authentication

Demonstrates how to compute the Authorization header for bol.com using HMAC-SHA256.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

; This example assumes the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.

$oCrypt = ObjCreate("Chilkat.Crypt2")

$oCrypt.EncodingMode = "base64"
$oCrypt.HashAlgorithm = "sha256"
$oCrypt.MacAlgorithm = "hmac"

Local $sPublicKey = "oRNWbHFXtAECmhnZmEndcjLIaSKbRMVE"
Local $sPrivateKey = "MaQHPOnmYkPZNgeRziPnQyyOJYytUbcFBVJBvbMKoDdpPqaZbaOiLUTWzPAkpPsZFZbJHrcoltdgpZolyNcgvvBaKcmkqFjucFzXhDONTsPAtHHyccQlLUZpkOuywMiOycDWcCySFsgpDiyGnCWCZJkNTtVdPxbSUTWVIFQiUxaPDYDXRQAVVTbSVZArAZkaLDLOoOvPzxSdhnkkJWzlQDkqsXNKfAIgAldrmyfROSyCGMCfvzdQdUQEaYZTPEoA"

; The string to sign is this:
; http_verb +'\n\n'+ content_type +'\n'+ x_bol_date +'\n'+ 'x-bol-date:'+ x_bol_date +'\n'+ uri

Local $sHttp_verb = "GET"
Local $sContent_type = "application/xml"
Local $sX_bol_date = "Wed, 17 Feb 2016 00:00:00 GMT"
Local $sUri = "/services/rest/orders/v2"

; IMPORTANT: Notice the use of underscore and hyphen (dash) chars in x-bol-date vs. x_bol_date.
; In one place hypens are used.  In two places, underscore chars are used.
$oSb = ObjCreate("Chilkat.StringBuilder")
$oSb.Append($sHttp_verb)
$oSb.Append(@LF & @LF)
$oSb.Append($sContent_type)
$oSb.Append(@LF)
$oSb.Append($sX_bol_date)
$oSb.Append(@LF & "x-bol-date:")
$oSb.Append($sX_bol_date)
$oSb.Append(@LF)
$oSb.Append($sUri)
ConsoleWrite("[" & $oSb.GetAsString() & "]" & @CRLF)

; Set the HMAC key:
$oCrypt.SetMacKeyEncoded($sPrivateKey,"ascii")
Local $sMac = $oCrypt.MacStringENC($oSb.GetAsString())

; The answer should be: nqzLWvXI1eBhBXrRx5NF23V5hS8Q1xWCloJzPi/RAts=
ConsoleWrite($sMac & @CRLF)

; The last step is to append the public key with the signature
$oSbHeader = ObjCreate("Chilkat.StringBuilder")
$oSbHeader.Append($sPublicKey)
$oSbHeader.Append(":")
$oSbHeader.Append($sMac)

Local $sHdrValue = $oSbHeader.GetAsString()
ConsoleWrite($sHdrValue & @CRLF)