(PureBasic) ING Open Banking OAuth2 Client Credentials

Demonstrates how to get an access token for the ING Open Banking APIs using client credentials.

For more information, see https://developer.ing.com/openbanking/get-started/openbanking

Chilkat PureBasic Module Download Chilkat PureBasic Module

IncludeFile "CkBinData.pb"
IncludeFile "CkDateTime.pb"
IncludeFile "CkPrivateKey.pb"
IncludeFile "CkHttp.pb"
IncludeFile "CkHttpResponse.pb"
IncludeFile "CkCrypt2.pb"
IncludeFile "CkHttpRequest.pb"
IncludeFile "CkStringBuilder.pb"
IncludeFile "CkRsa.pb"
IncludeFile "CkCert.pb"
IncludeFile "CkJsonObject.pb"

Procedure ChilkatExample()

    ; This example requires the Chilkat API to have been previously unlocked.
    ; See Global Unlock Sample for sample code.

    cert.i = CkCert::ckCreate()
    If cert.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success.i = CkCert::ckLoadFromFile(cert,"qa_data/certs_and_keys/ING/example_client_tls.cer")
    If success = 0
        Debug CkCert::ckLastErrorText(cert)
        CkCert::ckDispose(cert)
        ProcedureReturn
    EndIf

    bdPrivKey.i = CkBinData::ckCreate()
    If bdPrivKey.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkBinData::ckLoadFile(bdPrivKey,"qa_data/certs_and_keys/ING/example_client_tls.key")
    If success = 0
        Debug "Failed to load example_client_tls.key"
        CkCert::ckDispose(cert)
        CkBinData::ckDispose(bdPrivKey)
        ProcedureReturn
    EndIf

    ; The OAuth 2.0 client_id for these certificates is e77d776b-90af-4684-bebc-521e5b2614dd. 
    ; Please note down this client_id since you will need it in the next steps to call the API.

    privKey.i = CkPrivateKey::ckCreate()
    If privKey.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkPrivateKey::ckLoadAnyFormat(privKey,bdPrivKey,"")
    If success = 0
        Debug CkPrivateKey::ckLastErrorText(privKey)
        CkCert::ckDispose(cert)
        CkBinData::ckDispose(bdPrivKey)
        CkPrivateKey::ckDispose(privKey)
        ProcedureReturn
    EndIf

    ; Associate the private key with the certificate.
    success = CkCert::ckSetPrivateKey(cert,privKey)
    If success = 0
        Debug CkCert::ckLastErrorText(cert)
        CkCert::ckDispose(cert)
        CkBinData::ckDispose(bdPrivKey)
        CkPrivateKey::ckDispose(privKey)
        ProcedureReturn
    EndIf

    http.i = CkHttp::ckCreate()
    If http.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkHttp::ckSetSslClientCert(http,cert)
    If success = 0
        Debug CkHttp::ckLastErrorText(http)
        CkCert::ckDispose(cert)
        CkBinData::ckDispose(bdPrivKey)
        CkPrivateKey::ckDispose(privKey)
        CkHttp::ckDispose(http)
        ProcedureReturn
    EndIf

    ; Calculate the Digest and add the "Digest" header.  Do the equivalent of this:
    ; payload="grant_type=client_credentials"
    ; payloadDigest=`echo -n "$payload" | openssl dgst -binary -sha256 | openssl base64`
    ; digest=SHA-256=$payloadDigest
    crypt.i = CkCrypt2::ckCreate()
    If crypt.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkCrypt2::setCkHashAlgorithm(crypt, "SHA256")
    CkCrypt2::setCkEncodingMode(crypt, "base64")
    payload.s = "grant_type=client_credentials"
    payloadDigest.s = CkCrypt2::ckHashStringENC(crypt,payload)

    ; Calculate the current date/time and add the Date header.  
    ; reqDate=$(LC_TIME=en_US.UTF-8 date -u "+%a, %d %b %Y %H:%M:%S GMT")  
    dt.i = CkDateTime::ckCreate()
    If dt.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkDateTime::ckSetFromCurrentSystemTime(dt)
    ; The desire date/time format is the "RFC822" format.
    CkHttp::ckSetRequestHeader(http,"Date",CkDateTime::ckGetAsRfc822(dt,0))

    ; Calculate signature for signing your request
    ; Duplicate the following code:

    ; 	httpMethod="post"
    ; 	reqPath="/oauth2/token"
    ; 	signingString="(request-target): $httpMethod $reqPath
    ; 	date: $reqDate
    ; 	digest: $digest"
    ; 	signature=`printf "$signingString" | openssl dgst -sha256 -sign "${certPath}example_client_signing.key" -passin "pass:changeit" | openssl base64 -A`

    httpMethod.s = "POST"
    reqPath.s = "/oauth2/token"

    sbStringToSign.i = CkStringBuilder::ckCreate()
    If sbStringToSign.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkStringBuilder::ckAppend(sbStringToSign,"(request-target): ")
    CkStringBuilder::ckAppend(sbStringToSign,httpMethod)
    CkStringBuilder::ckToLowercase(sbStringToSign)
    CkStringBuilder::ckAppend(sbStringToSign," ")
    CkStringBuilder::ckAppendLine(sbStringToSign,reqPath,0)

    CkStringBuilder::ckAppend(sbStringToSign,"date: ")
    CkStringBuilder::ckAppendLine(sbStringToSign,CkDateTime::ckGetAsRfc822(dt,0),0)

    CkStringBuilder::ckAppend(sbStringToSign,"digest: SHA-256=")
    CkStringBuilder::ckAppend(sbStringToSign,payloadDigest)

    signingPrivKey.i = CkPrivateKey::ckCreate()
    If signingPrivKey.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkPrivateKey::ckLoadPemFile(signingPrivKey,"qa_data/certs_and_keys/ING/example_client_signing.key")
    If success = 0
        Debug CkPrivateKey::ckLastErrorText(signingPrivKey)
        CkCert::ckDispose(cert)
        CkBinData::ckDispose(bdPrivKey)
        CkPrivateKey::ckDispose(privKey)
        CkHttp::ckDispose(http)
        CkCrypt2::ckDispose(crypt)
        CkDateTime::ckDispose(dt)
        CkStringBuilder::ckDispose(sbStringToSign)
        CkPrivateKey::ckDispose(signingPrivKey)
        ProcedureReturn
    EndIf

    rsa.i = CkRsa::ckCreate()
    If rsa.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkRsa::ckImportPrivateKeyObj(rsa,signingPrivKey)
    If success = 0
        Debug CkRsa::ckLastErrorText(rsa)
        CkCert::ckDispose(cert)
        CkBinData::ckDispose(bdPrivKey)
        CkPrivateKey::ckDispose(privKey)
        CkHttp::ckDispose(http)
        CkCrypt2::ckDispose(crypt)
        CkDateTime::ckDispose(dt)
        CkStringBuilder::ckDispose(sbStringToSign)
        CkPrivateKey::ckDispose(signingPrivKey)
        CkRsa::ckDispose(rsa)
        ProcedureReturn
    EndIf

    CkRsa::setCkEncodingMode(rsa, "base64")
    b64Signature.s = CkRsa::ckSignStringENC(rsa,CkStringBuilder::ckGetAsString(sbStringToSign),"SHA256")

    sbAuthHdrVal.i = CkStringBuilder::ckCreate()
    If sbAuthHdrVal.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkStringBuilder::ckAppend(sbAuthHdrVal,"Signature keyId=" + Chr(34) + "e77d776b-90af-4684-bebc-521e5b2614dd" + Chr(34) + ",")
    CkStringBuilder::ckAppend(sbAuthHdrVal,"algorithm=" + Chr(34) + "rsa-sha256" + Chr(34) + ",")
    CkStringBuilder::ckAppend(sbAuthHdrVal,"headers=" + Chr(34) + "(request-target) date digest" + Chr(34) + ",")
    CkStringBuilder::ckAppend(sbAuthHdrVal,"signature=" + Chr(34))
    CkStringBuilder::ckAppend(sbAuthHdrVal,b64Signature)
    CkStringBuilder::ckAppend(sbAuthHdrVal,Chr(34))

    sbDigestHdrVal.i = CkStringBuilder::ckCreate()
    If sbDigestHdrVal.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkStringBuilder::ckAppend(sbDigestHdrVal,"SHA-256=")
    CkStringBuilder::ckAppend(sbDigestHdrVal,payloadDigest)

    ; Do the following CURL statement:

    ; 	curl -i -X POST "${httpHost}${reqPath}" \
    ; 	-H 'Accept: application/json' \
    ; 	-H 'Content-Type: application/x-www-form-urlencoded' \
    ; 	-H "Digest: ${digest}" \
    ; 	-H "Date: ${reqDate}" \
    ; 	-H "authorization: Signature keyId=\"$keyId\",algorithm=\"rsa-sha256\",headers=\"(request-target) date digest\",signature=\"$signature\"" \
    ; 	-d "${payload}" \
    ; 	--cert "${certPath}tlsCert.crt" \
    ; 	--key "${certPath}tlsCert.key"

    req.i = CkHttpRequest::ckCreate()
    If req.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkHttpRequest::ckAddParam(req,"grant_type","client_credentials")
    CkHttpRequest::ckAddHeader(req,"Accept","application/json")
    CkHttpRequest::ckAddHeader(req,"Date",CkDateTime::ckGetAsRfc822(dt,0))
    CkHttpRequest::ckAddHeader(req,"Digest",CkStringBuilder::ckGetAsString(sbDigestHdrVal))
    CkHttpRequest::ckAddHeader(req,"Authorization",CkStringBuilder::ckGetAsString(sbAuthHdrVal))
    resp.i = CkHttp::ckPostUrlEncoded(http,"https://api.sandbox.ing.com/oauth2/token",req)
    If CkHttp::ckLastMethodSuccess(http) = 0
        Debug CkHttp::ckLastErrorText(http)
        CkCert::ckDispose(cert)
        CkBinData::ckDispose(bdPrivKey)
        CkPrivateKey::ckDispose(privKey)
        CkHttp::ckDispose(http)
        CkCrypt2::ckDispose(crypt)
        CkDateTime::ckDispose(dt)
        CkStringBuilder::ckDispose(sbStringToSign)
        CkPrivateKey::ckDispose(signingPrivKey)
        CkRsa::ckDispose(rsa)
        CkStringBuilder::ckDispose(sbAuthHdrVal)
        CkStringBuilder::ckDispose(sbDigestHdrVal)
        CkHttpRequest::ckDispose(req)
        ProcedureReturn
    EndIf

    ; If successful, the status code = 200
    Debug "Response Status Code: " + Str(CkHttpResponse::ckStatusCode(resp))
    Debug CkHttpResponse::ckBodyStr(resp)

    json.i = CkJsonObject::ckCreate()
    If json.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkJsonObject::ckLoad(json,CkHttpResponse::ckBodyStr(resp))

    CkHttpResponse::ckDispose(resp)

    CkJsonObject::setCkEmitCompact(json, 0)
    Debug CkJsonObject::ckEmit(json)

    ; A successful response contains an access token such as:
    ; {
    ;   "access_token": "eyJhbGc ... bxI_SoPOBH9xmoM",
    ;   "expires_in": 905,
    ;   "scope": "payment-requests:view payment-requests:create payment-requests:close greetings:view virtual-ledger-accounts:fund-reservation:create virtual-ledger-accounts:fund-reservation:delete virtual-ledger-accounts:balance:view",
    ;   "token_type": "Bearer",
    ;   "keys": [
    ;     {
    ;       "kty": "RSA",
    ;       "n": "3l3rdz4...04VPkdV",
    ;       "e": "AQAB",
    ;       "use": "sig",
    ;       "alg": "RS256",
    ;       "x5t": "3c396700fc8cd709cf9cb5452a22bcde76985851"
    ;     }
    ;   ],
    ;   "client_id": "e77d776b-90af-4684-bebc-521e5b2614dd"
    ; }

    ; Use this online tool to generate parsing code from sample JSON: 
    ; Generate Parsing Code from JSON

    kty.s
    n.s
    e.s
    use.s
    alg.s
    x5t.s

    access_token.s = CkJsonObject::ckStringOf(json,"access_token")
    expires_in.i = CkJsonObject::ckIntOf(json,"expires_in")
    scope.s = CkJsonObject::ckStringOf(json,"scope")
    token_type.s = CkJsonObject::ckStringOf(json,"token_type")
    client_id.s = CkJsonObject::ckStringOf(json,"client_id")
    i.i = 0
    count_i.i = CkJsonObject::ckSizeOfArray(json,"keys")
    While i < count_i
        CkJsonObject::setCkI(json, i)
        kty = CkJsonObject::ckStringOf(json,"keys[i].kty")
        n = CkJsonObject::ckStringOf(json,"keys[i].n")
        e = CkJsonObject::ckStringOf(json,"keys[i].e")
        use = CkJsonObject::ckStringOf(json,"keys[i].use")
        alg = CkJsonObject::ckStringOf(json,"keys[i].alg")
        x5t = CkJsonObject::ckStringOf(json,"keys[i].x5t")
        i = i + 1
    Wend

    ; This example will save the JSON containing the access key to a file so that
    ; a subsequent example can load it and then use the access key for a request, such as to create a payment request.
    CkJsonObject::ckWriteFile(json,"qa_data/tokens/ing_access_token.json")


    CkCert::ckDispose(cert)
    CkBinData::ckDispose(bdPrivKey)
    CkPrivateKey::ckDispose(privKey)
    CkHttp::ckDispose(http)
    CkCrypt2::ckDispose(crypt)
    CkDateTime::ckDispose(dt)
    CkStringBuilder::ckDispose(sbStringToSign)
    CkPrivateKey::ckDispose(signingPrivKey)
    CkRsa::ckDispose(rsa)
    CkStringBuilder::ckDispose(sbAuthHdrVal)
    CkStringBuilder::ckDispose(sbDigestHdrVal)
    CkHttpRequest::ckDispose(req)
    CkJsonObject::ckDispose(json)


    ProcedureReturn
EndProcedure