(Delphi ActiveX) ING Open Banking OAuth2 Client Credentials

Demonstrates how to get an access token for the ING Open Banking APIs using client credentials.

For more information, see https://developer.ing.com/openbanking/get-started/openbanking

Chilkat for Delphi Downloads Chilkat ActiveX DLL for Delphi Chilkat non-ActiveX DLL for Delphi * The examples here use the ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Chilkat_TLB;

...

procedure TForm1.Button1Click(Sender: TObject);
var
cert: TChilkatCert;
success: Integer;
bdPrivKey: TChilkatBinData;
privKey: TPrivateKey;
http: TChilkatHttp;
crypt: TChilkatCrypt2;
payload: WideString;
payloadDigest: WideString;
dt: TCkDateTime;
httpMethod: WideString;
reqPath: WideString;
sbStringToSign: TChilkatStringBuilder;
signingPrivKey: TPrivateKey;
rsa: TChilkatRsa;
b64Signature: WideString;
sbAuthHdrVal: TChilkatStringBuilder;
sbDigestHdrVal: TChilkatStringBuilder;
req: TChilkatHttpRequest;
resp: IChilkatHttpResponse;
json: TChilkatJsonObject;
kty: WideString;
n: WideString;
e: WideString;
use: WideString;
alg: WideString;
x5t: WideString;
access_token: WideString;
expires_in: Integer;
scope: WideString;
token_type: WideString;
client_id: WideString;
i: Integer;
count_i: Integer;

begin
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

cert := TChilkatCert.Create(Self);
success := cert.LoadFromFile('qa_data/certs_and_keys/ING/example_client_tls.cer');
if (success = 0) then
  begin
    Memo1.Lines.Add(cert.LastErrorText);
    Exit;
  end;

bdPrivKey := TChilkatBinData.Create(Self);
success := bdPrivKey.LoadFile('qa_data/certs_and_keys/ING/example_client_tls.key');
if (success = 0) then
  begin
    Memo1.Lines.Add('Failed to load example_client_tls.key');
    Exit;
  end;

// The OAuth 2.0 client_id for these certificates is e77d776b-90af-4684-bebc-521e5b2614dd. 
// Please note down this client_id since you will need it in the next steps to call the API.

privKey := TPrivateKey.Create(Self);
success := privKey.LoadAnyFormat(bdPrivKey.ControlInterface,'');
if (success = 0) then
  begin
    Memo1.Lines.Add(privKey.LastErrorText);
    Exit;
  end;

// Associate the private key with the certificate.
success := cert.SetPrivateKey(privKey.ControlInterface);
if (success = 0) then
  begin
    Memo1.Lines.Add(cert.LastErrorText);
    Exit;
  end;

http := TChilkatHttp.Create(Self);

success := http.SetSslClientCert(cert.ControlInterface);
if (success = 0) then
  begin
    Memo1.Lines.Add(http.LastErrorText);
    Exit;
  end;

// Calculate the Digest and add the "Digest" header.  Do the equivalent of this:
// payload="grant_type=client_credentials"
// payloadDigest=`echo -n "$payload" | openssl dgst -binary -sha256 | openssl base64`
// digest=SHA-256=$payloadDigest
crypt := TChilkatCrypt2.Create(Self);
crypt.HashAlgorithm := 'SHA256';
crypt.EncodingMode := 'base64';
payload := 'grant_type=client_credentials';
payloadDigest := crypt.HashStringENC(payload);

// Calculate the current date/time and add the Date header.  
// reqDate=$(LC_TIME=en_US.UTF-8 date -u "+%a, %d %b %Y %H:%M:%S GMT")  
dt := TCkDateTime.Create(Self);
dt.SetFromCurrentSystemTime();
// The desire date/time format is the "RFC822" format.
http.SetRequestHeader('Date',dt.GetAsRfc822(0));

// Calculate signature for signing your request
// Duplicate the following code:

// 	httpMethod="post"
// 	reqPath="/oauth2/token"
// 	signingString="(request-target): $httpMethod $reqPath
// 	date: $reqDate
// 	digest: $digest"
// 	signature=`printf "$signingString" | openssl dgst -sha256 -sign "${certPath}example_client_signing.key" -passin "pass:changeit" | openssl base64 -A`

httpMethod := 'POST';
reqPath := '/oauth2/token';

sbStringToSign := TChilkatStringBuilder.Create(Self);
sbStringToSign.Append('(request-target): ');
sbStringToSign.Append(httpMethod);
sbStringToSign.ToLowercase();
sbStringToSign.Append(' ');
sbStringToSign.AppendLine(reqPath,0);

sbStringToSign.Append('date: ');
sbStringToSign.AppendLine(dt.GetAsRfc822(0),0);

sbStringToSign.Append('digest: SHA-256=');
sbStringToSign.Append(payloadDigest);

signingPrivKey := TPrivateKey.Create(Self);
success := signingPrivKey.LoadPemFile('qa_data/certs_and_keys/ING/example_client_signing.key');
if (success = 0) then
  begin
    Memo1.Lines.Add(signingPrivKey.LastErrorText);
    Exit;
  end;

rsa := TChilkatRsa.Create(Self);
success := rsa.ImportPrivateKeyObj(signingPrivKey.ControlInterface);
if (success = 0) then
  begin
    Memo1.Lines.Add(rsa.LastErrorText);
    Exit;
  end;

rsa.EncodingMode := 'base64';
b64Signature := rsa.SignStringENC(sbStringToSign.GetAsString(),'SHA256');

sbAuthHdrVal := TChilkatStringBuilder.Create(Self);
sbAuthHdrVal.Append('Signature keyId="e77d776b-90af-4684-bebc-521e5b2614dd",');
sbAuthHdrVal.Append('algorithm="rsa-sha256",');
sbAuthHdrVal.Append('headers="(request-target) date digest",');
sbAuthHdrVal.Append('signature="');
sbAuthHdrVal.Append(b64Signature);
sbAuthHdrVal.Append('"');

sbDigestHdrVal := TChilkatStringBuilder.Create(Self);
sbDigestHdrVal.Append('SHA-256=');
sbDigestHdrVal.Append(payloadDigest);

// Do the following CURL statement:

// 	curl -i -X POST "${httpHost}${reqPath}" \
// 	-H 'Accept: application/json' \
// 	-H 'Content-Type: application/x-www-form-urlencoded' \
// 	-H "Digest: ${digest}" \
// 	-H "Date: ${reqDate}" \
// 	-H "authorization: Signature keyId=\"$keyId\",algorithm=\"rsa-sha256\",headers=\"(request-target) date digest\",signature=\"$signature\"" \
// 	-d "${payload}" \
// 	--cert "${certPath}tlsCert.crt" \
// 	--key "${certPath}tlsCert.key"

req := TChilkatHttpRequest.Create(Self);
req.AddParam('grant_type','client_credentials');
req.AddHeader('Accept','application/json');
req.AddHeader('Date',dt.GetAsRfc822(0));
req.AddHeader('Digest',sbDigestHdrVal.GetAsString());
req.AddHeader('Authorization',sbAuthHdrVal.GetAsString());
resp := http.PostUrlEncoded('https://api.sandbox.ing.com/oauth2/token',req.ControlInterface);
if (http.LastMethodSuccess = 0) then
  begin
    Memo1.Lines.Add(http.LastErrorText);
    Exit;
  end;

// If successful, the status code = 200
Memo1.Lines.Add('Response Status Code: ' + IntToStr(resp.StatusCode));
Memo1.Lines.Add(resp.BodyStr);

json := TChilkatJsonObject.Create(Self);
json.Load(resp.BodyStr);

json.EmitCompact := 0;
Memo1.Lines.Add(json.Emit());

// A successful response contains an access token such as:
// {
//   "access_token": "eyJhbGc ... bxI_SoPOBH9xmoM",
//   "expires_in": 905,
//   "scope": "payment-requests:view payment-requests:create payment-requests:close greetings:view virtual-ledger-accounts:fund-reservation:create virtual-ledger-accounts:fund-reservation:delete virtual-ledger-accounts:balance:view",
//   "token_type": "Bearer",
//   "keys": [
//     {
//       "kty": "RSA",
//       "n": "3l3rdz4...04VPkdV",
//       "e": "AQAB",
//       "use": "sig",
//       "alg": "RS256",
//       "x5t": "3c396700fc8cd709cf9cb5452a22bcde76985851"
//     }
//   ],
//   "client_id": "e77d776b-90af-4684-bebc-521e5b2614dd"
// }

// Use this online tool to generate parsing code from sample JSON: 
// Generate Parsing Code from JSON

access_token := json.StringOf('access_token');
expires_in := json.IntOf('expires_in');
scope := json.StringOf('scope');
token_type := json.StringOf('token_type');
client_id := json.StringOf('client_id');
i := 0;
count_i := json.SizeOfArray('keys');
while i < count_i do
  begin
    json.I := i;
    kty := json.StringOf('keys[i].kty');
    n := json.StringOf('keys[i].n');
    e := json.StringOf('keys[i].e');
    use := json.StringOf('keys[i].use');
    alg := json.StringOf('keys[i].alg');
    x5t := json.StringOf('keys[i].x5t');
    i := i + 1;
  end;

// This example will save the JSON containing the access key to a file so that
// a subsequent example can load it and then use the access key for a request, such as to create a payment request.
json.WriteFile('qa_data/tokens/ing_access_token.json');
end;