(C) ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request.

For more information, see https://developer.ebay.com/develop/guides/digital-signatures-for-apis

Chilkat C/C++ Library Downloads
MS Visual C/C++ Linux/CentOS C/C++ Alpine Linux C/C++ MAC OS X C/C++	armhf/aarch64 C/C++ C++ Builder iOS C/C++ Android C/C++	Solaris C/C++ MinGW C/C++

#include <C_CkStringBuilder.h>
#include <C_CkDateTime.h>
#include <C_CkBinData.h>
#include <C_CkPrivateKey.h>
#include <C_CkEdDSA.h>
#include <C_CkHttp.h>
#include <C_CkHttpResponse.h>

void ChilkatSample(void)
    {
    BOOL success;
    const char *strPrivateKey;
    const char *strPublicKey;
    const char *strJwe;
    HCkStringBuilder sbBody;
    HCkStringBuilder sbSigBase;
    HCkStringBuilder sbSigInput;
    HCkDateTime dt;
    const char *unixTimeNow;
    HCkBinData bdPrivKey;
    HCkPrivateKey privKey;
    HCkBinData bdToBeSigned;
    HCkEdDSA eddsa;
    const char *sigBase64;
    HCkHttp http;
    HCkStringBuilder sbContentDigestHdr;
    HCkStringBuilder sbSigHdr;
    const char *url;
    HCkHttpResponse resp;

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Ebay provides a Key Management API
    // See https://developer.ebay.com/api-docs/developer/key-management/overview.html

    // The following test keys can be used: 
    // 
    // Ed25519 
    // 
    // Private Key:
    // 
    // -----BEGIN PRIVATE KEY-----
    // MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
    // -----END PRIVATE KEY-----

    strPrivateKey = "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF";

    // 
    // Public Key:
    // 
    // -----BEGIN PUBLIC KEY-----
    // MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
    // -----END PUBLIC KEY-----

    strPublicKey = "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=";

    // This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
    // This JWE is just for example:
    strJwe = "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw";

    sbBody = CkStringBuilder_Create();
    CkStringBuilder_Append(sbBody,"{\"hello\": \"world\"}");

    printf("Body of request:\n");
    printf("%s\n",CkStringBuilder_getAsString(sbBody));

    // -------------------------------------------------
    // Build the signature base string...

    sbSigBase = CkStringBuilder_Create();

    CkStringBuilder_Append(sbSigBase,"\"content-digest\": sha-256=:");
    CkStringBuilder_Append(sbSigBase,CkStringBuilder_getHash(sbBody,"sha256","base64","utf-8"));
    CkStringBuilder_Append(sbSigBase,":\n");

    CkStringBuilder_Append(sbSigBase,"\"x-ebay-signature-key\": ");
    CkStringBuilder_Append(sbSigBase,strJwe);
    CkStringBuilder_Append(sbSigBase,"\n");

    CkStringBuilder_Append(sbSigBase,"\"@method\": POST\n");

    // This is the path part of the URL without query params...
    CkStringBuilder_Append(sbSigBase,"\"@path\": ");
    CkStringBuilder_Append(sbSigBase,"/verifysignature");
    CkStringBuilder_Append(sbSigBase,"\n");

    // The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
    // In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
    // Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
    CkStringBuilder_Append(sbSigBase,"\"@authority\": ");
    CkStringBuilder_Append(sbSigBase,"localhost:8080");
    CkStringBuilder_Append(sbSigBase,"\n");

    CkStringBuilder_Append(sbSigBase,"\"@signature-params\": ");

    sbSigInput = CkStringBuilder_Create();
    CkStringBuilder_Append(sbSigInput,"(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")");
    CkStringBuilder_Append(sbSigInput,";created=");

    dt = CkDateTime_Create();
    CkDateTime_SetFromCurrentSystemTime(dt);
    unixTimeNow = CkDateTime_getAsUnixTimeStr(dt,FALSE);
    CkStringBuilder_Append(sbSigInput,unixTimeNow);

    CkStringBuilder_AppendSb(sbSigBase,sbSigInput);

    // -------------------------------------------------
    // Sign the signature base string using the Ed25519 private key

    bdPrivKey = CkBinData_Create();
    CkBinData_AppendEncoded(bdPrivKey,strPrivateKey,"base64");

    privKey = CkPrivateKey_Create();
    success = CkPrivateKey_LoadAnyFormat(privKey,bdPrivKey,"");
    if (success == FALSE) {
        printf("%s\n",CkPrivateKey_lastErrorText(privKey));
        CkStringBuilder_Dispose(sbBody);
        CkStringBuilder_Dispose(sbSigBase);
        CkStringBuilder_Dispose(sbSigInput);
        CkDateTime_Dispose(dt);
        CkBinData_Dispose(bdPrivKey);
        CkPrivateKey_Dispose(privKey);
        return;
    }

    bdToBeSigned = CkBinData_Create();
    CkBinData_AppendSb(bdToBeSigned,sbSigBase,"utf-8");

    eddsa = CkEdDSA_Create();
    sigBase64 = CkEdDSA_signBdENC(eddsa,bdToBeSigned,"base64",privKey);
    if (CkEdDSA_getLastMethodSuccess(eddsa) == FALSE) {
        printf("%s\n",CkEdDSA_lastErrorText(eddsa));
        CkStringBuilder_Dispose(sbBody);
        CkStringBuilder_Dispose(sbSigBase);
        CkStringBuilder_Dispose(sbSigInput);
        CkDateTime_Dispose(dt);
        CkBinData_Dispose(bdPrivKey);
        CkPrivateKey_Dispose(privKey);
        CkBinData_Dispose(bdToBeSigned);
        CkEdDSA_Dispose(eddsa);
        return;
    }

    printf("sigBase64:\n");
    printf("%s\n",sigBase64);

    // ----------------------------------------------------------
    // Send the JSON POST

    http = CkHttp_Create();

    CkHttp_SetRequestHeader(http,"x-ebay-signature-key",strJwe);

    sbContentDigestHdr = CkStringBuilder_Create();
    CkStringBuilder_Append(sbContentDigestHdr,"sha-256=:");
    CkStringBuilder_Append(sbContentDigestHdr,CkStringBuilder_getHash(sbBody,"sha256","base64","utf-8"));
    CkStringBuilder_Append(sbContentDigestHdr,":");
    CkHttp_SetRequestHeader(http,"Content-Digest",CkStringBuilder_getAsString(sbContentDigestHdr));

    sbSigHdr = CkStringBuilder_Create();
    CkStringBuilder_Append(sbSigHdr,"sig1=:");
    CkStringBuilder_Append(sbSigHdr,sigBase64);
    CkStringBuilder_Append(sbSigHdr,":");
    CkHttp_SetRequestHeader(http,"Signature",CkStringBuilder_getAsString(sbSigHdr));

    CkStringBuilder_Prepend(sbSigInput,"sig1=");
    CkHttp_SetRequestHeader(http,"Signature-Input",CkStringBuilder_getAsString(sbSigInput));

    // Add this header to make eBay actually check the signature.
    CkHttp_SetRequestHeader(http,"x-ebay-enforce-signature","true");

    // Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
    CkHttp_putAuthToken(http,"your_oauth2_access_token");

    // The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
    // Normally, you'll send your POST to some api.ebay.com endpoint.
    url = "http://localhost:8080/verifysignature";

    resp = CkHttp_PostJson2(http,"http://localhost:8080/verifysignature","application/json",CkStringBuilder_getAsString(sbBody));
    if (CkHttp_getLastMethodSuccess(http) == FALSE) {
        printf("%s\n",CkHttp_lastErrorText(http));
        CkStringBuilder_Dispose(sbBody);
        CkStringBuilder_Dispose(sbSigBase);
        CkStringBuilder_Dispose(sbSigInput);
        CkDateTime_Dispose(dt);
        CkBinData_Dispose(bdPrivKey);
        CkPrivateKey_Dispose(privKey);
        CkBinData_Dispose(bdToBeSigned);
        CkEdDSA_Dispose(eddsa);
        CkHttp_Dispose(http);
        CkStringBuilder_Dispose(sbContentDigestHdr);
        CkStringBuilder_Dispose(sbSigHdr);
        return;
    }

    printf("Response status code: %d\n",CkHttpResponse_getStatusCode(resp));
    printf("Response body:\n");
    printf("%s\n",CkHttpResponse_bodyStr(resp));

    CkHttpResponse_Dispose(resp);


    CkStringBuilder_Dispose(sbBody);
    CkStringBuilder_Dispose(sbSigBase);
    CkStringBuilder_Dispose(sbSigInput);
    CkDateTime_Dispose(dt);
    CkBinData_Dispose(bdPrivKey);
    CkPrivateKey_Dispose(privKey);
    CkBinData_Dispose(bdToBeSigned);
    CkEdDSA_Dispose(eddsa);
    CkHttp_Dispose(http);
    CkStringBuilder_Dispose(sbContentDigestHdr);
    CkStringBuilder_Dispose(sbSigHdr);

    }