(Delphi DLL) ING Open Banking OAuth2 Client Credentials

Demonstrates how to get an access token for the ING Open Banking APIs using client credentials.

Note: This example requires Chilkat v11.0.0 or greater.

For more information, see https://developer.ing.com/openbanking/get-started/openbanking

Chilkat for Delphi Downloads Chilkat non-ActiveX DLL for Delphi Chilkat ActiveX DLL for Delphi * The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, CkDateTime, Rsa, HttpResponse, JsonObject, Http, BinData, PrivateKey, StringBuilder, Cert, Crypt2, HttpRequest;

...

procedure TForm1.Button1Click(Sender: TObject);
var
success: Boolean;
cert: HCkCert;
bdPrivKey: HCkBinData;
privKey: HCkPrivateKey;
http: HCkHttp;
crypt: HCkCrypt2;
payload: PWideChar;
payloadDigest: PWideChar;
dt: HCkDateTime;
httpMethod: PWideChar;
reqPath: PWideChar;
sbStringToSign: HCkStringBuilder;
signingPrivKey: HCkPrivateKey;
rsa: HCkRsa;
b64Signature: PWideChar;
sbAuthHdrVal: HCkStringBuilder;
sbDigestHdrVal: HCkStringBuilder;
req: HCkHttpRequest;
resp: HCkHttpResponse;
json: HCkJsonObject;
kty: PWideChar;
n: PWideChar;
e: PWideChar;
use: PWideChar;
alg: PWideChar;
x5t: PWideChar;
access_token: PWideChar;
expires_in: Integer;
scope: PWideChar;
token_type: PWideChar;
client_id: PWideChar;
i: Integer;
count_i: Integer;

begin
success := False;

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

cert := CkCert_Create();
success := CkCert_LoadFromFile(cert,'qa_data/certs_and_keys/ING/example_client_tls.cer');
if (success = False) then
  begin
    Memo1.Lines.Add(CkCert__lastErrorText(cert));
    Exit;
  end;

bdPrivKey := CkBinData_Create();
success := CkBinData_LoadFile(bdPrivKey,'qa_data/certs_and_keys/ING/example_client_tls.key');
if (success = False) then
  begin
    Memo1.Lines.Add('Failed to load example_client_tls.key');
    Exit;
  end;

// The OAuth 2.0 client_id for these certificates is e77d776b-90af-4684-bebc-521e5b2614dd. 
// Please note down this client_id since you will need it in the next steps to call the API.

privKey := CkPrivateKey_Create();
success := CkPrivateKey_LoadAnyFormat(privKey,bdPrivKey,'');
if (success = False) then
  begin
    Memo1.Lines.Add(CkPrivateKey__lastErrorText(privKey));
    Exit;
  end;

// Associate the private key with the certificate.
success := CkCert_SetPrivateKey(cert,privKey);
if (success = False) then
  begin
    Memo1.Lines.Add(CkCert__lastErrorText(cert));
    Exit;
  end;

http := CkHttp_Create();

success := CkHttp_SetSslClientCert(http,cert);
if (success = False) then
  begin
    Memo1.Lines.Add(CkHttp__lastErrorText(http));
    Exit;
  end;

// Calculate the Digest and add the "Digest" header.  Do the equivalent of this:
// payload="grant_type=client_credentials"
// payloadDigest=`echo -n "$payload" | openssl dgst -binary -sha256 | openssl base64`
// digest=SHA-256=$payloadDigest
crypt := CkCrypt2_Create();
CkCrypt2_putHashAlgorithm(crypt,'SHA256');
CkCrypt2_putEncodingMode(crypt,'base64');
payload := 'grant_type=client_credentials';
payloadDigest := CkCrypt2__hashStringENC(crypt,payload);

// Calculate the current date/time and add the Date header.  
// reqDate=$(LC_TIME=en_US.UTF-8 date -u "+%a, %d %b %Y %H:%M:%S GMT")  
dt := CkDateTime_Create();
CkDateTime_SetFromCurrentSystemTime(dt);
// The desire date/time format is the "RFC822" format.
CkHttp_SetRequestHeader(http,'Date',CkDateTime__getAsRfc822(dt,False));

// Calculate signature for signing your request
// Duplicate the following code:

// 	httpMethod="post"
// 	reqPath="/oauth2/token"
// 	signingString="(request-target): $httpMethod $reqPath
// 	date: $reqDate
// 	digest: $digest"
// 	signature=`printf "$signingString" | openssl dgst -sha256 -sign "${certPath}example_client_signing.key" -passin "pass:changeit" | openssl base64 -A`

httpMethod := 'POST';
reqPath := '/oauth2/token';

sbStringToSign := CkStringBuilder_Create();
CkStringBuilder_Append(sbStringToSign,'(request-target): ');
CkStringBuilder_Append(sbStringToSign,httpMethod);
CkStringBuilder_ToLowercase(sbStringToSign);
CkStringBuilder_Append(sbStringToSign,' ');
CkStringBuilder_AppendLine(sbStringToSign,reqPath,False);

CkStringBuilder_Append(sbStringToSign,'date: ');
CkStringBuilder_AppendLine(sbStringToSign,CkDateTime__getAsRfc822(dt,False),False);

CkStringBuilder_Append(sbStringToSign,'digest: SHA-256=');
CkStringBuilder_Append(sbStringToSign,payloadDigest);

signingPrivKey := CkPrivateKey_Create();
success := CkPrivateKey_LoadPemFile(signingPrivKey,'qa_data/certs_and_keys/ING/example_client_signing.key');
if (success = False) then
  begin
    Memo1.Lines.Add(CkPrivateKey__lastErrorText(signingPrivKey));
    Exit;
  end;

rsa := CkRsa_Create();
success := CkRsa_UsePrivateKey(rsa,signingPrivKey);
if (success = False) then
  begin
    Memo1.Lines.Add(CkRsa__lastErrorText(rsa));
    Exit;
  end;

CkRsa_putEncodingMode(rsa,'base64');
b64Signature := CkRsa__signStringENC(rsa,CkStringBuilder__getAsString(sbStringToSign),'SHA256');

sbAuthHdrVal := CkStringBuilder_Create();
CkStringBuilder_Append(sbAuthHdrVal,'Signature keyId="e77d776b-90af-4684-bebc-521e5b2614dd",');
CkStringBuilder_Append(sbAuthHdrVal,'algorithm="rsa-sha256",');
CkStringBuilder_Append(sbAuthHdrVal,'headers="(request-target) date digest",');
CkStringBuilder_Append(sbAuthHdrVal,'signature="');
CkStringBuilder_Append(sbAuthHdrVal,b64Signature);
CkStringBuilder_Append(sbAuthHdrVal,'"');

sbDigestHdrVal := CkStringBuilder_Create();
CkStringBuilder_Append(sbDigestHdrVal,'SHA-256=');
CkStringBuilder_Append(sbDigestHdrVal,payloadDigest);

// Do the following CURL statement:

// 	curl -i -X POST "${httpHost}${reqPath}" \
// 	-H 'Accept: application/json' \
// 	-H 'Content-Type: application/x-www-form-urlencoded' \
// 	-H "Digest: ${digest}" \
// 	-H "Date: ${reqDate}" \
// 	-H "authorization: Signature keyId=\"$keyId\",algorithm=\"rsa-sha256\",headers=\"(request-target) date digest\",signature=\"$signature\"" \
// 	-d "${payload}" \
// 	--cert "${certPath}tlsCert.crt" \
// 	--key "${certPath}tlsCert.key"

req := CkHttpRequest_Create();
CkHttpRequest_AddParam(req,'grant_type','client_credentials');
CkHttpRequest_AddHeader(req,'Accept','application/json');
CkHttpRequest_AddHeader(req,'Date',CkDateTime__getAsRfc822(dt,False));
CkHttpRequest_AddHeader(req,'Digest',CkStringBuilder__getAsString(sbDigestHdrVal));
CkHttpRequest_AddHeader(req,'Authorization',CkStringBuilder__getAsString(sbAuthHdrVal));

CkHttpRequest_putHttpVerb(req,'POST');
CkHttpRequest_putContentType(req,'application/x-www-form-urlencoded');

resp := CkHttpResponse_Create();
success := CkHttp_HttpReq(http,'https://api.sandbox.ing.com/oauth2/token',req,resp);
if (success = False) then
  begin
    Memo1.Lines.Add(CkHttp__lastErrorText(http));
    Exit;
  end;

// If successful, the status code = 200
Memo1.Lines.Add('Response Status Code: ' + IntToStr(CkHttpResponse_getStatusCode(resp)));
Memo1.Lines.Add(CkHttpResponse__bodyStr(resp));

json := CkJsonObject_Create();
CkJsonObject_Load(json,CkHttpResponse__bodyStr(resp));

CkJsonObject_putEmitCompact(json,False);
Memo1.Lines.Add(CkJsonObject__emit(json));

// A successful response contains an access token such as:
// {
//   "access_token": "eyJhbGc ... bxI_SoPOBH9xmoM",
//   "expires_in": 905,
//   "scope": "payment-requests:view payment-requests:create payment-requests:close greetings:view virtual-ledger-accounts:fund-reservation:create virtual-ledger-accounts:fund-reservation:delete virtual-ledger-accounts:balance:view",
//   "token_type": "Bearer",
//   "keys": [
//     {
//       "kty": "RSA",
//       "n": "3l3rdz4...04VPkdV",
//       "e": "AQAB",
//       "use": "sig",
//       "alg": "RS256",
//       "x5t": "3c396700fc8cd709cf9cb5452a22bcde76985851"
//     }
//   ],
//   "client_id": "e77d776b-90af-4684-bebc-521e5b2614dd"
// }

// Use this online tool to generate parsing code from sample JSON: 
// Generate Parsing Code from JSON

access_token := CkJsonObject__stringOf(json,'access_token');
expires_in := CkJsonObject_IntOf(json,'expires_in');
scope := CkJsonObject__stringOf(json,'scope');
token_type := CkJsonObject__stringOf(json,'token_type');
client_id := CkJsonObject__stringOf(json,'client_id');
i := 0;
count_i := CkJsonObject_SizeOfArray(json,'keys');
while i < count_i do
  begin
    CkJsonObject_putI(json,i);
    kty := CkJsonObject__stringOf(json,'keys[i].kty');
    n := CkJsonObject__stringOf(json,'keys[i].n');
    e := CkJsonObject__stringOf(json,'keys[i].e');
    use := CkJsonObject__stringOf(json,'keys[i].use');
    alg := CkJsonObject__stringOf(json,'keys[i].alg');
    x5t := CkJsonObject__stringOf(json,'keys[i].x5t');
    i := i + 1;
  end;

// This example will save the JSON containing the access key to a file so that
// a subsequent example can load it and then use the access key for a request, such as to create a payment request.
CkJsonObject_WriteFile(json,'qa_data/tokens/ing_access_token.json');

CkCert_Dispose(cert);
CkBinData_Dispose(bdPrivKey);
CkPrivateKey_Dispose(privKey);
CkHttp_Dispose(http);
CkCrypt2_Dispose(crypt);
CkDateTime_Dispose(dt);
CkStringBuilder_Dispose(sbStringToSign);
CkPrivateKey_Dispose(signingPrivKey);
CkRsa_Dispose(rsa);
CkStringBuilder_Dispose(sbAuthHdrVal);
CkStringBuilder_Dispose(sbDigestHdrVal);
CkHttpRequest_Dispose(req);
CkHttpResponse_Dispose(resp);
CkJsonObject_Dispose(json);

end;