(Go) ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request.

For more information, see https://developer.ebay.com/develop/guides/digital-signatures-for-apis

Chilkat Go Downloads Go Package for Windows, MacOS, Linux, Alpine Linux, Solaris

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    var success bool

    // Note: Ebay provides a Key Management API
    // See https://developer.ebay.com/api-docs/developer/key-management/overview.html

    // The following test keys can be used: 
    // 
    // Ed25519 
    // 
    // Private Key:
    // 
    // -----BEGIN PRIVATE KEY-----
    // MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
    // -----END PRIVATE KEY-----

    strPrivateKey := "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF"

    // 
    // Public Key:
    // 
    // -----BEGIN PUBLIC KEY-----
    // MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
    // -----END PUBLIC KEY-----

    strPublicKey := "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs="

    // This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
    // This JWE is just for example:
    strJwe := "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw"

    sbBody := chilkat.NewStringBuilder()
    sbBody.Append("{\"hello\": \"world\"}")

    fmt.Println("Body of request:")
    fmt.Println(*sbBody.GetAsString())

    // -------------------------------------------------
    // Build the signature base string...

    sbSigBase := chilkat.NewStringBuilder()

    sbSigBase.Append("\"content-digest\": sha-256=:")
    sbSigBase.Append(*sbBody.GetHash("sha256","base64","utf-8"))
    sbSigBase.Append(":\n")

    sbSigBase.Append("\"x-ebay-signature-key\": ")
    sbSigBase.Append(strJwe)
    sbSigBase.Append("\n")

    sbSigBase.Append("\"@method\": POST\n")

    // This is the path part of the URL without query params...
    sbSigBase.Append("\"@path\": ")
    sbSigBase.Append("/verifysignature")
    sbSigBase.Append("\n")

    // The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
    // In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
    // Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
    sbSigBase.Append("\"@authority\": ")
    sbSigBase.Append("localhost:8080")
    sbSigBase.Append("\n")

    sbSigBase.Append("\"@signature-params\": ")

    sbSigInput := chilkat.NewStringBuilder()
    sbSigInput.Append("(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")")
    sbSigInput.Append(";created=")

    dt := chilkat.NewCkDateTime()
    dt.SetFromCurrentSystemTime()
    unixTimeNow := dt.GetAsUnixTimeStr(false)
    sbSigInput.Append(*unixTimeNow)

    sbSigBase.AppendSb(sbSigInput)

    // -------------------------------------------------
    // Sign the signature base string using the Ed25519 private key

    bdPrivKey := chilkat.NewBinData()
    bdPrivKey.AppendEncoded(strPrivateKey,"base64")

    privKey := chilkat.NewPrivateKey()
    success = privKey.LoadAnyFormat(bdPrivKey,"")
    if success == false {
        fmt.Println(privKey.LastErrorText())
        sbBody.DisposeStringBuilder()
        sbSigBase.DisposeStringBuilder()
        sbSigInput.DisposeStringBuilder()
        dt.DisposeCkDateTime()
        bdPrivKey.DisposeBinData()
        privKey.DisposePrivateKey()
        return
    }

    bdToBeSigned := chilkat.NewBinData()
    bdToBeSigned.AppendSb(sbSigBase,"utf-8")

    eddsa := chilkat.NewEdDSA()
    sigBase64 := eddsa.SignBdENC(bdToBeSigned,"base64",privKey)
    if eddsa.LastMethodSuccess() == false {
        fmt.Println(eddsa.LastErrorText())
        sbBody.DisposeStringBuilder()
        sbSigBase.DisposeStringBuilder()
        sbSigInput.DisposeStringBuilder()
        dt.DisposeCkDateTime()
        bdPrivKey.DisposeBinData()
        privKey.DisposePrivateKey()
        bdToBeSigned.DisposeBinData()
        eddsa.DisposeEdDSA()
        return
    }

    fmt.Println("sigBase64:")
    fmt.Println(*sigBase64)

    // ----------------------------------------------------------
    // Send the JSON POST

    http := chilkat.NewHttp()

    http.SetRequestHeader("x-ebay-signature-key",strJwe)

    sbContentDigestHdr := chilkat.NewStringBuilder()
    sbContentDigestHdr.Append("sha-256=:")
    sbContentDigestHdr.Append(*sbBody.GetHash("sha256","base64","utf-8"))
    sbContentDigestHdr.Append(":")
    http.SetRequestHeader("Content-Digest",*sbContentDigestHdr.GetAsString())

    sbSigHdr := chilkat.NewStringBuilder()
    sbSigHdr.Append("sig1=:")
    sbSigHdr.Append(*sigBase64)
    sbSigHdr.Append(":")
    http.SetRequestHeader("Signature",*sbSigHdr.GetAsString())

    sbSigInput.Prepend("sig1=")
    http.SetRequestHeader("Signature-Input",*sbSigInput.GetAsString())

    // Add this header to make eBay actually check the signature.
    http.SetRequestHeader("x-ebay-enforce-signature","true")

    // Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
    http.SetAuthToken("your_oauth2_access_token")

    // The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
    // Normally, you'll send your POST to some api.ebay.com endpoint.
    url := "http://localhost:8080/verifysignature"

    resp := http.PostJson2("http://localhost:8080/verifysignature","application/json",*sbBody.GetAsString())
    if http.LastMethodSuccess() == false {
        fmt.Println(http.LastErrorText())
        sbBody.DisposeStringBuilder()
        sbSigBase.DisposeStringBuilder()
        sbSigInput.DisposeStringBuilder()
        dt.DisposeCkDateTime()
        bdPrivKey.DisposeBinData()
        privKey.DisposePrivateKey()
        bdToBeSigned.DisposeBinData()
        eddsa.DisposeEdDSA()
        http.DisposeHttp()
        sbContentDigestHdr.DisposeStringBuilder()
        sbSigHdr.DisposeStringBuilder()
        return
    }

    fmt.Println("Response status code: ", resp.StatusCode())
    fmt.Println("Response body:")
    fmt.Println(resp.BodyStr())

    resp.DisposeHttpResponse()

    sbBody.DisposeStringBuilder()
    sbSigBase.DisposeStringBuilder()
    sbSigInput.DisposeStringBuilder()
    dt.DisposeCkDateTime()
    bdPrivKey.DisposeBinData()
    privKey.DisposePrivateKey()
    bdToBeSigned.DisposeBinData()
    eddsa.DisposeEdDSA()
    http.DisposeHttp()
    sbContentDigestHdr.DisposeStringBuilder()
    sbSigHdr.DisposeStringBuilder()