(Node.js) Plaza API (bol.com) HMAC-SHA256 Authentication

Demonstrates how to compute the Authorization header for bol.com using HMAC-SHA256.

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOSX, and ARM

var os = require('os');
if (os.platform() == 'win32') {  
    if (os.arch() == 'ia32') {
        var chilkat = require('@chilkat/ck-node21-win-ia32');
    } else {
        var chilkat = require('@chilkat/ck-node21-win64'); 
    }
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node21-arm');
    } else if (os.arch() == 'x86') {
        var chilkat = require('@chilkat/ck-node21-linux32');
    } else {
        var chilkat = require('@chilkat/ck-node21-linux64');
    }
} else if (os.platform() == 'darwin') {
    if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node21-mac-m1');
    } else {
        var chilkat = require('@chilkat/ck-node21-macosx');
    }
}

function chilkatExample() {

    // This example assumes the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    var crypt = new chilkat.Crypt2();

    crypt.EncodingMode = "base64";
    crypt.HashAlgorithm = "sha256";
    crypt.MacAlgorithm = "hmac";

    var publicKey = "oRNWbHFXtAECmhnZmEndcjLIaSKbRMVE";
    var privateKey = "MaQHPOnmYkPZNgeRziPnQyyOJYytUbcFBVJBvbMKoDdpPqaZbaOiLUTWzPAkpPsZFZbJHrcoltdgpZolyNcgvvBaKcmkqFjucFzXhDONTsPAtHHyccQlLUZpkOuywMiOycDWcCySFsgpDiyGnCWCZJkNTtVdPxbSUTWVIFQiUxaPDYDXRQAVVTbSVZArAZkaLDLOoOvPzxSdhnkkJWzlQDkqsXNKfAIgAldrmyfROSyCGMCfvzdQdUQEaYZTPEoA";

    // The string to sign is this:
    // http_verb +'\n\n'+ content_type +'\n'+ x_bol_date +'\n'+ 'x-bol-date:'+ x_bol_date +'\n'+ uri

    var http_verb = "GET";
    var content_type = "application/xml";
    var x_bol_date = "Wed, 17 Feb 2016 00:00:00 GMT";
    var uri = "/services/rest/orders/v2";

    // IMPORTANT: Notice the use of underscore and hyphen (dash) chars in x-bol-date vs. x_bol_date.
    // In one place hypens are used.  In two places, underscore chars are used.
    var sb = new chilkat.StringBuilder();
    sb.Append(http_verb);
    sb.Append("\n\n");
    sb.Append(content_type);
    sb.Append("\n");
    sb.Append(x_bol_date);
    sb.Append("\nx-bol-date:");
    sb.Append(x_bol_date);
    sb.Append("\n");
    sb.Append(uri);
    console.log("[" + sb.GetAsString() + "]");

    // Set the HMAC key:
    crypt.SetMacKeyEncoded(privateKey,"ascii");
    var mac = crypt.MacStringENC(sb.GetAsString());

    // The answer should be: nqzLWvXI1eBhBXrRx5NF23V5hS8Q1xWCloJzPi/RAts=
    console.log(mac);

    // The last step is to append the public key with the signature
    var sbHeader = new chilkat.StringBuilder();
    sbHeader.Append(publicKey);
    sbHeader.Append(":");
    sbHeader.Append(mac);

    var hdrValue = sbHeader.GetAsString();
    console.log(hdrValue);

}

chilkatExample();