(PowerBuilder) ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request.

For more information, see https://developer.ebay.com/develop/guides/digital-signatures-for-apis

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

integer li_rc
integer li_Success
string ls_StrPrivateKey
string ls_StrPublicKey
string ls_StrJwe
oleobject loo_SbBody
oleobject loo_SbSigBase
oleobject loo_SbSigInput
oleobject loo_Dt
string ls_UnixTimeNow
oleobject loo_BdPrivKey
oleobject loo_PrivKey
oleobject loo_BdToBeSigned
oleobject loo_Eddsa
string ls_SigBase64
oleobject loo_Http
oleobject loo_SbContentDigestHdr
oleobject loo_SbSigHdr
string ls_Url
oleobject loo_Resp

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Note: Ebay provides a Key Management API
// See https://developer.ebay.com/api-docs/developer/key-management/overview.html

// The following test keys can be used: 
// 
// Ed25519 
// 
// Private Key:
// 
// -----BEGIN PRIVATE KEY-----
// MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
// -----END PRIVATE KEY-----

ls_StrPrivateKey = "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF"

// 
// Public Key:
// 
// -----BEGIN PUBLIC KEY-----
// MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
// -----END PUBLIC KEY-----

ls_StrPublicKey = "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs="

// This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
// This JWE is just for example:
ls_StrJwe = "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw"

loo_SbBody = create oleobject
li_rc = loo_SbBody.ConnectToNewObject("Chilkat_9_5_0.StringBuilder")
if li_rc < 0 then
    destroy loo_SbBody
    MessageBox("Error","Connecting to COM object failed")
    return
end if
loo_SbBody.Append("{\"hello\": \"world\"}")

Write-Debug "Body of request:"
Write-Debug loo_SbBody.GetAsString()

// -------------------------------------------------
// Build the signature base string...

loo_SbSigBase = create oleobject
li_rc = loo_SbSigBase.ConnectToNewObject("Chilkat_9_5_0.StringBuilder")

loo_SbSigBase.Append("\"content-digest\": sha-256=:")
loo_SbSigBase.Append(loo_SbBody.GetHash("sha256","base64","utf-8"))
loo_SbSigBase.Append(":~n")

loo_SbSigBase.Append("\"x-ebay-signature-key\": ")
loo_SbSigBase.Append(ls_StrJwe)
loo_SbSigBase.Append("~n")

loo_SbSigBase.Append("\"@method\": POST~n")

// This is the path part of the URL without query params...
loo_SbSigBase.Append("\"@path\": ")
loo_SbSigBase.Append("/verifysignature")
loo_SbSigBase.Append("~n")

// The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
// In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
// Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
loo_SbSigBase.Append("\"@authority\": ")
loo_SbSigBase.Append("localhost:8080")
loo_SbSigBase.Append("~n")

loo_SbSigBase.Append("\"@signature-params\": ")

loo_SbSigInput = create oleobject
li_rc = loo_SbSigInput.ConnectToNewObject("Chilkat_9_5_0.StringBuilder")

loo_SbSigInput.Append("(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")")
loo_SbSigInput.Append(";created=")

loo_Dt = create oleobject
li_rc = loo_Dt.ConnectToNewObject("Chilkat_9_5_0.CkDateTime")

loo_Dt.SetFromCurrentSystemTime()
ls_UnixTimeNow = loo_Dt.GetAsUnixTimeStr(0)
loo_SbSigInput.Append(ls_UnixTimeNow)

loo_SbSigBase.AppendSb(loo_SbSigInput)

// -------------------------------------------------
// Sign the signature base string using the Ed25519 private key

loo_BdPrivKey = create oleobject
li_rc = loo_BdPrivKey.ConnectToNewObject("Chilkat_9_5_0.BinData")

loo_BdPrivKey.AppendEncoded(ls_StrPrivateKey,"base64")

loo_PrivKey = create oleobject
li_rc = loo_PrivKey.ConnectToNewObject("Chilkat_9_5_0.PrivateKey")

li_Success = loo_PrivKey.LoadAnyFormat(loo_BdPrivKey,"")
if li_Success = 0 then
    Write-Debug loo_PrivKey.LastErrorText
    destroy loo_SbBody
    destroy loo_SbSigBase
    destroy loo_SbSigInput
    destroy loo_Dt
    destroy loo_BdPrivKey
    destroy loo_PrivKey
    return
end if

loo_BdToBeSigned = create oleobject
li_rc = loo_BdToBeSigned.ConnectToNewObject("Chilkat_9_5_0.BinData")

loo_BdToBeSigned.AppendSb(loo_SbSigBase,"utf-8")

loo_Eddsa = create oleobject
li_rc = loo_Eddsa.ConnectToNewObject("Chilkat_9_5_0.EdDSA")

ls_SigBase64 = loo_Eddsa.SignBdENC(loo_BdToBeSigned,"base64",loo_PrivKey)
if loo_Eddsa.LastMethodSuccess = 0 then
    Write-Debug loo_Eddsa.LastErrorText
    destroy loo_SbBody
    destroy loo_SbSigBase
    destroy loo_SbSigInput
    destroy loo_Dt
    destroy loo_BdPrivKey
    destroy loo_PrivKey
    destroy loo_BdToBeSigned
    destroy loo_Eddsa
    return
end if

Write-Debug "sigBase64:"
Write-Debug ls_SigBase64

// ----------------------------------------------------------
// Send the JSON POST

loo_Http = create oleobject
li_rc = loo_Http.ConnectToNewObject("Chilkat_9_5_0.Http")

loo_Http.SetRequestHeader("x-ebay-signature-key",ls_StrJwe)

loo_SbContentDigestHdr = create oleobject
li_rc = loo_SbContentDigestHdr.ConnectToNewObject("Chilkat_9_5_0.StringBuilder")

loo_SbContentDigestHdr.Append("sha-256=:")
loo_SbContentDigestHdr.Append(loo_SbBody.GetHash("sha256","base64","utf-8"))
loo_SbContentDigestHdr.Append(":")
loo_Http.SetRequestHeader("Content-Digest",loo_SbContentDigestHdr.GetAsString())

loo_SbSigHdr = create oleobject
li_rc = loo_SbSigHdr.ConnectToNewObject("Chilkat_9_5_0.StringBuilder")

loo_SbSigHdr.Append("sig1=:")
loo_SbSigHdr.Append(ls_SigBase64)
loo_SbSigHdr.Append(":")
loo_Http.SetRequestHeader("Signature",loo_SbSigHdr.GetAsString())

loo_SbSigInput.Prepend("sig1=")
loo_Http.SetRequestHeader("Signature-Input",loo_SbSigInput.GetAsString())

// Add this header to make eBay actually check the signature.
loo_Http.SetRequestHeader("x-ebay-enforce-signature","true")

// Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
loo_Http.AuthToken = "your_oauth2_access_token"

// The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
// Normally, you'll send your POST to some api.ebay.com endpoint.
ls_Url = "http://localhost:8080/verifysignature"

loo_Resp = loo_Http.PostJson2("http://localhost:8080/verifysignature","application/json",loo_SbBody.GetAsString())
if loo_Http.LastMethodSuccess = 0 then
    Write-Debug loo_Http.LastErrorText
    destroy loo_SbBody
    destroy loo_SbSigBase
    destroy loo_SbSigInput
    destroy loo_Dt
    destroy loo_BdPrivKey
    destroy loo_PrivKey
    destroy loo_BdToBeSigned
    destroy loo_Eddsa
    destroy loo_Http
    destroy loo_SbContentDigestHdr
    destroy loo_SbSigHdr
    return
end if

Write-Debug "Response status code: " + string(loo_Resp.StatusCode)
Write-Debug "Response body:"
Write-Debug loo_Resp.BodyStr

destroy loo_Resp


destroy loo_SbBody
destroy loo_SbSigBase
destroy loo_SbSigInput
destroy loo_Dt
destroy loo_BdPrivKey
destroy loo_PrivKey
destroy loo_BdToBeSigned
destroy loo_Eddsa
destroy loo_Http
destroy loo_SbContentDigestHdr
destroy loo_SbSigHdr