(Tcl) ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request.

For more information, see https://developer.ebay.com/develop/guides/digital-signatures-for-apis

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# Note: Ebay provides a Key Management API
# See https://developer.ebay.com/api-docs/developer/key-management/overview.html

# The following test keys can be used: 
# 
# Ed25519 
# 
# Private Key:
# 
# -----BEGIN PRIVATE KEY-----
# MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
# -----END PRIVATE KEY-----

set strPrivateKey "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF"

# 
# Public Key:
# 
# -----BEGIN PUBLIC KEY-----
# MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
# -----END PUBLIC KEY-----

set strPublicKey "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs="

# This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
# This JWE is just for example:
set strJwe "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw"

set sbBody [new_CkStringBuilder]

CkStringBuilder_Append $sbBody "{\"hello\": \"world\"}"

puts "Body of request:"
puts [CkStringBuilder_getAsString $sbBody]

# -------------------------------------------------
# Build the signature base string...

set sbSigBase [new_CkStringBuilder]

CkStringBuilder_Append $sbSigBase "\"content-digest\": sha-256=:"
CkStringBuilder_Append $sbSigBase [CkStringBuilder_getHash $sbBody "sha256" "base64" "utf-8"]
CkStringBuilder_Append $sbSigBase ":\n"

CkStringBuilder_Append $sbSigBase "\"x-ebay-signature-key\": "
CkStringBuilder_Append $sbSigBase $strJwe
CkStringBuilder_Append $sbSigBase "\n"

CkStringBuilder_Append $sbSigBase "\"@method\": POST\n"

# This is the path part of the URL without query params...
CkStringBuilder_Append $sbSigBase "\"@path\": "
CkStringBuilder_Append $sbSigBase "/verifysignature"
CkStringBuilder_Append $sbSigBase "\n"

# The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
# In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
# Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
CkStringBuilder_Append $sbSigBase "\"@authority\": "
CkStringBuilder_Append $sbSigBase "localhost:8080"
CkStringBuilder_Append $sbSigBase "\n"

CkStringBuilder_Append $sbSigBase "\"@signature-params\": "

set sbSigInput [new_CkStringBuilder]

CkStringBuilder_Append $sbSigInput "(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")"
CkStringBuilder_Append $sbSigInput ";created="

set dt [new_CkDateTime]

CkDateTime_SetFromCurrentSystemTime $dt
set unixTimeNow [CkDateTime_getAsUnixTimeStr $dt 0]
CkStringBuilder_Append $sbSigInput $unixTimeNow

CkStringBuilder_AppendSb $sbSigBase $sbSigInput

# -------------------------------------------------
# Sign the signature base string using the Ed25519 private key

set bdPrivKey [new_CkBinData]

CkBinData_AppendEncoded $bdPrivKey $strPrivateKey "base64"

set privKey [new_CkPrivateKey]

set success [CkPrivateKey_LoadAnyFormat $privKey $bdPrivKey ""]
if {$success == 0} then {
    puts [CkPrivateKey_lastErrorText $privKey]
    delete_CkStringBuilder $sbBody
    delete_CkStringBuilder $sbSigBase
    delete_CkStringBuilder $sbSigInput
    delete_CkDateTime $dt
    delete_CkBinData $bdPrivKey
    delete_CkPrivateKey $privKey
    exit
}

set bdToBeSigned [new_CkBinData]

CkBinData_AppendSb $bdToBeSigned $sbSigBase "utf-8"

set eddsa [new_CkEdDSA]

set sigBase64 [CkEdDSA_signBdENC $eddsa $bdToBeSigned "base64" $privKey]
if {[CkEdDSA_get_LastMethodSuccess $eddsa] == 0} then {
    puts [CkEdDSA_lastErrorText $eddsa]
    delete_CkStringBuilder $sbBody
    delete_CkStringBuilder $sbSigBase
    delete_CkStringBuilder $sbSigInput
    delete_CkDateTime $dt
    delete_CkBinData $bdPrivKey
    delete_CkPrivateKey $privKey
    delete_CkBinData $bdToBeSigned
    delete_CkEdDSA $eddsa
    exit
}

puts "sigBase64:"
puts "$sigBase64"

# ----------------------------------------------------------
# Send the JSON POST

set http [new_CkHttp]

CkHttp_SetRequestHeader $http "x-ebay-signature-key" $strJwe

set sbContentDigestHdr [new_CkStringBuilder]

CkStringBuilder_Append $sbContentDigestHdr "sha-256=:"
CkStringBuilder_Append $sbContentDigestHdr [CkStringBuilder_getHash $sbBody "sha256" "base64" "utf-8"]
CkStringBuilder_Append $sbContentDigestHdr ":"
CkHttp_SetRequestHeader $http "Content-Digest" [CkStringBuilder_getAsString $sbContentDigestHdr]

set sbSigHdr [new_CkStringBuilder]

CkStringBuilder_Append $sbSigHdr "sig1=:"
CkStringBuilder_Append $sbSigHdr $sigBase64
CkStringBuilder_Append $sbSigHdr ":"
CkHttp_SetRequestHeader $http "Signature" [CkStringBuilder_getAsString $sbSigHdr]

CkStringBuilder_Prepend $sbSigInput "sig1="
CkHttp_SetRequestHeader $http "Signature-Input" [CkStringBuilder_getAsString $sbSigInput]

# Add this header to make eBay actually check the signature.
CkHttp_SetRequestHeader $http "x-ebay-enforce-signature" "true"

# Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
CkHttp_put_AuthToken $http "your_oauth2_access_token"

# The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
# Normally, you'll send your POST to some api.ebay.com endpoint.
set url "http://localhost:8080/verifysignature"

# resp is a CkHttpResponse
set resp [CkHttp_PostJson2 $http "http://localhost:8080/verifysignature" "application/json" [CkStringBuilder_getAsString $sbBody]]
if {[CkHttp_get_LastMethodSuccess $http] == 0} then {
    puts [CkHttp_lastErrorText $http]
    delete_CkStringBuilder $sbBody
    delete_CkStringBuilder $sbSigBase
    delete_CkStringBuilder $sbSigInput
    delete_CkDateTime $dt
    delete_CkBinData $bdPrivKey
    delete_CkPrivateKey $privKey
    delete_CkBinData $bdToBeSigned
    delete_CkEdDSA $eddsa
    delete_CkHttp $http
    delete_CkStringBuilder $sbContentDigestHdr
    delete_CkStringBuilder $sbSigHdr
    exit
}

puts "Response status code: [CkHttpResponse_get_StatusCode $resp]"
puts "Response body:"
puts [CkHttpResponse_bodyStr $resp]

delete_CkHttpResponse $resp


delete_CkStringBuilder $sbBody
delete_CkStringBuilder $sbSigBase
delete_CkStringBuilder $sbSigInput
delete_CkDateTime $dt
delete_CkBinData $bdPrivKey
delete_CkPrivateKey $privKey
delete_CkBinData $bdToBeSigned
delete_CkEdDSA $eddsa
delete_CkHttp $http
delete_CkStringBuilder $sbContentDigestHdr
delete_CkStringBuilder $sbSigHdr