Rust Requires Chilkat v11.0.0+

ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request. Rust

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Note: Ebay provides a Key Management API
// See https://developer.ebay.com/api-docs/developer/key-management/overview.html

// The following test keys can be used: 
// 
// Ed25519 
// 
// Private Key:
// 
// -----BEGIN PRIVATE KEY-----
// MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
// -----END PRIVATE KEY-----

let str_private_key = "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF".to_string();

// Public Key:
// 
// -----BEGIN PUBLIC KEY-----
// MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
// -----END PUBLIC KEY-----

let str_public_key = "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=".to_string();

// This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
// This JWE is just for example:
let str_jwe = "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw".to_string();

let sb_body = chilkat::StringBuilder::new();
let _ = sb_body.append("{\"hello\": \"world\"}");

println!("Body of request:");
println!("{}", sb_body.get_as_string().unwrap_or_default());

// -------------------------------------------------
// Build the signature base string...

let sb_sig_base = chilkat::StringBuilder::new();

let _ = sb_sig_base.append("\"content-digest\": sha-256=:");
let _ = sb_sig_base.append(&sb_body.get_hash("sha256", "base64", "utf-8").unwrap_or_default());
let _ = sb_sig_base.append(":\n");

let _ = sb_sig_base.append("\"x-ebay-signature-key\": ");
let _ = sb_sig_base.append(&str_jwe);
let _ = sb_sig_base.append("\n");

let _ = sb_sig_base.append("\"@method\": POST\n");

// This is the path part of the URL without query params...
let _ = sb_sig_base.append("\"@path\": ");
let _ = sb_sig_base.append("/verifysignature");
let _ = sb_sig_base.append("\n");

// The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
// In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
// Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
let _ = sb_sig_base.append("\"@authority\": ");
let _ = sb_sig_base.append("localhost:8080");
let _ = sb_sig_base.append("\n");

let _ = sb_sig_base.append("\"@signature-params\": ");

let sb_sig_input = chilkat::StringBuilder::new();
let _ = sb_sig_input.append("(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")");
let _ = sb_sig_input.append(";created=");

let dt = chilkat::DateTime::new();
let _ = dt.set_from_current_system_time();
let unix_time_now = dt.get_as_unix_time_str(false).unwrap_or_default();
let _ = sb_sig_input.append(&unix_time_now);

let _ = sb_sig_base.append_sb(&sb_sig_input);

// -------------------------------------------------
// Sign the signature base string using the Ed25519 private key

let bd_priv_key = chilkat::BinData::new();
let _ = bd_priv_key.append_encoded(&str_private_key, "base64");

let priv_key = chilkat::PrivateKey::new();
if priv_key.load_any_format(&bd_priv_key, "").is_err() {
    println!("{}", priv_key.last_error_text());
    return;
}

let bd_to_be_signed = chilkat::BinData::new();
let _ = bd_to_be_signed.append_sb(&sb_sig_base, "utf-8");

let eddsa = chilkat::EdDSA::new();
let Ok(sig_base64) = eddsa.sign_bd_enc(&bd_to_be_signed, "base64", &priv_key) else {
    println!("{}", eddsa.last_error_text());
    return;
};

println!("sigBase64:");
println!("{}", sig_base64);

// ----------------------------------------------------------
// Send the JSON POST

let http = chilkat::Http::new();

http.set_request_header("x-ebay-signature-key", &str_jwe);

let sb_content_digest_hdr = chilkat::StringBuilder::new();
let _ = sb_content_digest_hdr.append("sha-256=:");
let _ = sb_content_digest_hdr.append(&sb_body.get_hash("sha256", "base64", "utf-8").unwrap_or_default());
let _ = sb_content_digest_hdr.append(":");
http.set_request_header("Content-Digest", &sb_content_digest_hdr.get_as_string().unwrap_or_default());

let sb_sig_hdr = chilkat::StringBuilder::new();
let _ = sb_sig_hdr.append("sig1=:");
let _ = sb_sig_hdr.append(&sig_base64);
let _ = sb_sig_hdr.append(":");
http.set_request_header("Signature", &sb_sig_hdr.get_as_string().unwrap_or_default());

let _ = sb_sig_input.prepend("sig1=");
http.set_request_header("Signature-Input", &sb_sig_input.get_as_string().unwrap_or_default());

// Add this header to make eBay actually check the signature.
http.set_request_header("x-ebay-enforce-signature", "true");

// Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
http.set_auth_token("your_oauth2_access_token");

// The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
// Normally, you'll send your POST to some api.ebay.com endpoint.
let url = "http://localhost:8080/verifysignature".to_string();

let json_str = sb_body.get_as_string().unwrap_or_default();
let resp = chilkat::HttpResponse::new();
if http.http_str("POST", "http://localhost:8080/verifysignature", &json_str, "utf-8", "application/json", &resp).is_err() {
    println!("{}", http.last_error_text());
    return;
}

println!("Response status code: {}", resp.status_code());
println!("Response body:");
println!("{}", resp.body_str());