(DataFlex) Xero 2 Legged OAuth for Private Application

This example demonstrates the REST object for 2-legged OAuth for a private application.

Note: This example requires Chilkat v9.5.0.64 or later.

An application can setup OAuth1 for a given instance of the Chilkat REST object, and then use the instance for many REST API calls. This example demonstrates the OAuth1 setup and initial connection. This code would typically be placed in a subroutine/function to "initalize" the REST object before beginning to use it for REST HTTP requests.

Note: Xero private applications use 2 legged OAuth and bypass the user authorization workflow in the standard OAuth process. Private applications are linked to a single Xero organisation which is chosen when you register your application. In summary: 2-legged OAuth1 is for applications that access the data that they themselves own.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

Use ChilkatAx-win32.pkg

Procedure Test
    Handle hoRest
    String sConsumerKey
    String sConsumerSecret
    Handle hoPfx
    Boolean iSuccess
    Variant vPrivKeyFromPfx
    Handle hoPrivKeyFromPfx
    Handle hoPrivKeyFromPem
    Variant vOauth1
    Handle hoOauth1
    Boolean iBAutoReconnect
    String sTemp1
    Boolean bTemp1

    // This example requires Chilkat v9.5.0.64 or later

    // This sample code would typically be placed in a subroutine or function
    // where the rest object is passed by reference.
    // It does the OAuth1 setup and makes the initial connection.
    Get Create (RefClass(cComChilkatRest)) To hoRest
    If (Not(IsComObjectCreated(hoRest))) Begin
        Send CreateComObject of hoRest
    End

    Move "XERO_PRIVATE_APP_KEY" To sConsumerKey
    Move "XERO_PRIVATE_APP_SECRET" To sConsumerSecret

    // Let's get our private key from our PFX (password protected), or the PEM (unprotected).
    // You can decide which to use.  Either is OK, although I would recommend keeping your
    // private keys in a PFX and not in an unprotected PEM.
    Get Create (RefClass(cComChilkatPfx)) To hoPfx
    If (Not(IsComObjectCreated(hoPfx))) Begin
        Send CreateComObject of hoPfx
    End
    Get ComLoadPfxFile Of hoPfx "qa_data/certs/xero_private_app/public_privatekey.pfx" "PFX_PASSWORD" To iSuccess
    If (iSuccess <> True) Begin
        Get ComLastErrorText Of hoPfx To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get ComGetPrivateKey Of hoPfx 0 To vPrivKeyFromPfx
    If (IsComObject(vPrivKeyFromPfx)) Begin
        Get Create (RefClass(cComChilkatPrivateKey)) To hoPrivKeyFromPfx
        Set pvComObject Of hoPrivKeyFromPfx To vPrivKeyFromPfx
    End
    Get ComLastMethodSuccess Of hoPfx To bTemp1
    If (bTemp1 <> True) Begin
        Get ComLastErrorText Of hoPfx To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Or we can load from a PEM..
    Get Create (RefClass(cComChilkatPrivateKey)) To hoPrivKeyFromPem
    If (Not(IsComObjectCreated(hoPrivKeyFromPem))) Begin
        Send CreateComObject of hoPrivKeyFromPem
    End
    Get ComLoadPemFile Of hoPrivKeyFromPem "qa_data/certs/xero_private_app/privatekey.pem" To iSuccess
    If (iSuccess <> True) Begin
        Get ComLastErrorText Of hoPrivKeyFromPem To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Note: There are many other means for loading a private key, including
    // from other formats and directly from memory (i.e. not file-based).

    Get Create (RefClass(cComChilkatOAuth1)) To hoOauth1
    If (Not(IsComObjectCreated(hoOauth1))) Begin
        Send CreateComObject of hoOauth1
    End
    Set ComConsumerKey Of hoOauth1 To sConsumerKey
    Set ComConsumerSecret Of hoOauth1 To sConsumerSecret
    Set ComToken Of hoOauth1 To sConsumerKey
    Set ComTokenSecret Of hoOauth1 To sConsumerSecret
    Set ComSignatureMethod Of hoOauth1 To "RSA-SHA1"
    Get ComSetRsaKey Of hoOauth1 vPrivKeyFromPfx To iSuccess
    Send Destroy of hoPrivKeyFromPfx

    // Make the initial connection.
    // A single REST object, once connected, can be used for many Xero REST API calls.
    // The auto-reconnect indicates that if the already-established HTTPS connection is closed,
    // then it will be automatically re-established as needed.
    Move True To iBAutoReconnect
    Get ComConnect Of hoRest "api.xero.com" 443 True iBAutoReconnect To iSuccess
    If (iSuccess <> True) Begin
        Get ComLastErrorText Of hoRest To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Finally, install the OAuth1 authenticator.
    // (It make no difference whether this happens before or after the
    // connection is established.)
    Get pvComObject of hoOauth1 to vOauth1
    Get ComSetAuthOAuth1 Of hoRest vOauth1 False To iSuccess

    Showln "OK, the Xero OAuth1 is initialized and the REST object is ready to make REST API calls.."


End_Procedure