AutoIt

ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request. AutoIt

Local $bSuccess = False

; This example requires the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.

; Note: Ebay provides a Key Management API
; See https://developer.ebay.com/api-docs/developer/key-management/overview.html

; The following test keys can be used: 
; 
; Ed25519 
; 
; Private Key:
; 
; -----BEGIN PRIVATE KEY-----
; MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
; -----END PRIVATE KEY-----

Local $strPrivateKey = "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF"

; 
; Public Key:
; 
; -----BEGIN PUBLIC KEY-----
; MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
; -----END PUBLIC KEY-----

Local $strPublicKey = "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs="

; This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
; This JWE is just for example:
Local $strJwe = "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw"

$oSbBody = ObjCreate("Chilkat.StringBuilder")
$oSbBody.Append("{""hello"": ""world""}")

ConsoleWrite("Body of request:" & @CRLF)
ConsoleWrite($oSbBody.GetAsString() & @CRLF)

; -------------------------------------------------
; Build the signature base string...

$oSbSigBase = ObjCreate("Chilkat.StringBuilder")

$oSbSigBase.Append("""content-digest"": sha-256=:")
$oSbSigBase.Append($oSbBody.GetHash("sha256","base64","utf-8"))
$oSbSigBase.Append(":" & @LF)

$oSbSigBase.Append("""x-ebay-signature-key"": ")
$oSbSigBase.Append($strJwe)
$oSbSigBase.Append(@LF)

$oSbSigBase.Append("""@method"": POST" & @LF)

; This is the path part of the URL without query params...
$oSbSigBase.Append("""@path"": ")
$oSbSigBase.Append("/verifysignature")
$oSbSigBase.Append(@LF)

; The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
; In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
; Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
$oSbSigBase.Append("""@authority"": ")
$oSbSigBase.Append("localhost:8080")
$oSbSigBase.Append(@LF)

$oSbSigBase.Append("""@signature-params"": ")

$oSbSigInput = ObjCreate("Chilkat.StringBuilder")
$oSbSigInput.Append("(""content-digest"" ""x-ebay-signature-key"" ""@method"" ""@path"" ""@authority"")")
$oSbSigInput.Append(";created=")

$oDt = ObjCreate("Chilkat.CkDateTime")
$oDt.SetFromCurrentSystemTime()
Local $sUnixTimeNow = $oDt.GetAsUnixTimeStr(False)
$oSbSigInput.Append($sUnixTimeNow)

$oSbSigBase.AppendSb($oSbSigInput)

; -------------------------------------------------
; Sign the signature base string using the Ed25519 private key

$oBdPrivKey = ObjCreate("Chilkat.BinData")
$oBdPrivKey.AppendEncoded($strPrivateKey,"base64")

$oPrivKey = ObjCreate("Chilkat.PrivateKey")
$bSuccess = $oPrivKey.LoadAnyFormat($oBdPrivKey,"")
If ($bSuccess = False) Then
    ConsoleWrite($oPrivKey.LastErrorText & @CRLF)
    Exit
EndIf

$oBdToBeSigned = ObjCreate("Chilkat.BinData")
$oBdToBeSigned.AppendSb($oSbSigBase,"utf-8")

$oEddsa = ObjCreate("Chilkat.EdDSA")
Local $sigBase64 = $oEddsa.SignBdENC($oBdToBeSigned,"base64",$oPrivKey)
If ($oEddsa.LastMethodSuccess = False) Then
    ConsoleWrite($oEddsa.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite("sigBase64:" & @CRLF)
ConsoleWrite($sigBase64 & @CRLF)

; ----------------------------------------------------------
; Send the JSON POST

$oHttp = ObjCreate("Chilkat.Http")

$oHttp.SetRequestHeader "x-ebay-signature-key",$strJwe

$oSbContentDigestHdr = ObjCreate("Chilkat.StringBuilder")
$oSbContentDigestHdr.Append("sha-256=:")
$oSbContentDigestHdr.Append($oSbBody.GetHash("sha256","base64","utf-8"))
$oSbContentDigestHdr.Append(":")
$oHttp.SetRequestHeader "Content-Digest",$oSbContentDigestHdr.GetAsString()

$oSbSigHdr = ObjCreate("Chilkat.StringBuilder")
$oSbSigHdr.Append("sig1=:")
$oSbSigHdr.Append($sigBase64)
$oSbSigHdr.Append(":")
$oHttp.SetRequestHeader "Signature",$oSbSigHdr.GetAsString()

$oSbSigInput.Prepend("sig1=")
$oHttp.SetRequestHeader "Signature-Input",$oSbSigInput.GetAsString()

; Add this header to make eBay actually check the signature.
$oHttp.SetRequestHeader "x-ebay-enforce-signature","true"

; Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
$oHttp.AuthToken = "your_oauth2_access_token"

; The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
; Normally, you'll send your POST to some api.ebay.com endpoint.
Local $sUrl = "http://localhost:8080/verifysignature"

Local $sJsonStr = $oSbBody.GetAsString()
$oResp = ObjCreate("Chilkat.HttpResponse")
$bSuccess = $oHttp.HttpStr("POST","http://localhost:8080/verifysignature",$sJsonStr,"utf-8","application/json",$oResp)
If ($bSuccess = False) Then
    ConsoleWrite($oHttp.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite("Response status code: " & $oResp.StatusCode & @CRLF)
ConsoleWrite("Response body:" & @CRLF)
ConsoleWrite($oResp.BodyStr & @CRLF)