Lianja Requires Chilkat v11.0.0+

ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request. Lianja

llSuccess = .F.

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  Note: Ebay provides a Key Management API
//  See https://developer.ebay.com/api-docs/developer/key-management/overview.html

//  The following test keys can be used: 
//  
//  Ed25519 
//  
//  Private Key:
//  
//  -----BEGIN PRIVATE KEY-----
//  MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
//  -----END PRIVATE KEY-----

lcStrPrivateKey = "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF"

//  Public Key:
//  
//  -----BEGIN PUBLIC KEY-----
//  MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
//  -----END PUBLIC KEY-----

lcStrPublicKey = "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs="

//  This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
//  This JWE is just for example:
lcStrJwe = "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw"

loSbBody = createobject("CkStringBuilder")
loSbBody.Append('{"hello": "world"}')

? "Body of request:"
? loSbBody.GetAsString()

//  -------------------------------------------------
//  Build the signature base string...

loSbSigBase = createobject("CkStringBuilder")

loSbSigBase.Append('"content-digest": sha-256=:')
loSbSigBase.Append(loSbBody.GetHash("sha256","base64","utf-8"))
loSbSigBase.Append(":" + Chr(10))

loSbSigBase.Append('"x-ebay-signature-key": ')
loSbSigBase.Append(lcStrJwe)
loSbSigBase.Append(Chr(10))

loSbSigBase.Append('"@method": POST' + Chr(10))

//  This is the path part of the URL without query params...
loSbSigBase.Append('"@path": ')
loSbSigBase.Append("/verifysignature")
loSbSigBase.Append(Chr(10))

//  The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
//  In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
//  Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
loSbSigBase.Append('"@authority": ')
loSbSigBase.Append("localhost:8080")
loSbSigBase.Append(Chr(10))

loSbSigBase.Append('"@signature-params": ')

loSbSigInput = createobject("CkStringBuilder")
loSbSigInput.Append('("content-digest" "x-ebay-signature-key" "@method" "@path" "@authority")')
loSbSigInput.Append(";created=")

loDt = createobject("CkDateTime")
loDt.SetFromCurrentSystemTime()
lcUnixTimeNow = loDt.GetAsUnixTimeStr(.F.)
loSbSigInput.Append(lcUnixTimeNow)

loSbSigBase.AppendSb(loSbSigInput)

//  -------------------------------------------------
//  Sign the signature base string using the Ed25519 private key

loBdPrivKey = createobject("CkBinData")
loBdPrivKey.AppendEncoded(lcStrPrivateKey,"base64")

loPrivKey = createobject("CkPrivateKey")
llSuccess = loPrivKey.LoadAnyFormat(loBdPrivKey,"")
if (llSuccess = .F.) then
    ? loPrivKey.LastErrorText
    release loSbBody
    release loSbSigBase
    release loSbSigInput
    release loDt
    release loBdPrivKey
    release loPrivKey
    return
endif

loBdToBeSigned = createobject("CkBinData")
loBdToBeSigned.AppendSb(loSbSigBase,"utf-8")

loEddsa = createobject("CkEdDSA")
lcSigBase64 = loEddsa.SignBdENC(loBdToBeSigned,"base64",loPrivKey)
if (loEddsa.LastMethodSuccess = .F.) then
    ? loEddsa.LastErrorText
    release loSbBody
    release loSbSigBase
    release loSbSigInput
    release loDt
    release loBdPrivKey
    release loPrivKey
    release loBdToBeSigned
    release loEddsa
    return
endif

? "sigBase64:"
? lcSigBase64

//  ----------------------------------------------------------
//  Send the JSON POST

loHttp = createobject("CkHttp")

loHttp.SetRequestHeader("x-ebay-signature-key",lcStrJwe)

loSbContentDigestHdr = createobject("CkStringBuilder")
loSbContentDigestHdr.Append("sha-256=:")
loSbContentDigestHdr.Append(loSbBody.GetHash("sha256","base64","utf-8"))
loSbContentDigestHdr.Append(":")
loHttp.SetRequestHeader("Content-Digest",loSbContentDigestHdr.GetAsString())

loSbSigHdr = createobject("CkStringBuilder")
loSbSigHdr.Append("sig1=:")
loSbSigHdr.Append(lcSigBase64)
loSbSigHdr.Append(":")
loHttp.SetRequestHeader("Signature",loSbSigHdr.GetAsString())

loSbSigInput.Prepend("sig1=")
loHttp.SetRequestHeader("Signature-Input",loSbSigInput.GetAsString())

//  Add this header to make eBay actually check the signature.
loHttp.SetRequestHeader("x-ebay-enforce-signature","true")

//  Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
loHttp.AuthToken = "your_oauth2_access_token"

//  The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
//  Normally, you'll send your POST to some api.ebay.com endpoint.
lcUrl = "http://localhost:8080/verifysignature"

lcJsonStr = loSbBody.GetAsString()
loResp = createobject("CkHttpResponse")
llSuccess = loHttp.HttpStr("POST","http://localhost:8080/verifysignature",lcJsonStr,"utf-8","application/json",loResp)
if (llSuccess = .F.) then
    ? loHttp.LastErrorText
    release loSbBody
    release loSbSigBase
    release loSbSigInput
    release loDt
    release loBdPrivKey
    release loPrivKey
    release loBdToBeSigned
    release loEddsa
    release loHttp
    release loSbContentDigestHdr
    release loSbSigHdr
    release loResp
    return
endif

? "Response status code: " + str(loResp.StatusCode)
? "Response body:"
? loResp.BodyStr


release loSbBody
release loSbSigBase
release loSbSigInput
release loDt
release loBdPrivKey
release loPrivKey
release loBdToBeSigned
release loEddsa
release loHttp
release loSbContentDigestHdr
release loSbSigHdr
release loResp