Xbase++ Requires Chilkat v11.0.0+

ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request. Xbase++

LOCAL nSuccess
LOCAL cStrPrivateKey
LOCAL cStrPublicKey
LOCAL cStrJwe
LOCAL oSbBody
LOCAL oSbSigBase
LOCAL oSbSigInput
LOCAL oDt
LOCAL cUnixTimeNow
LOCAL oBdPrivKey
LOCAL oPrivKey
LOCAL oBdToBeSigned
LOCAL oEddsa
LOCAL cSigBase64
LOCAL oHttp
LOCAL oSbContentDigestHdr
LOCAL oSbSigHdr
LOCAL cUrl
LOCAL cJsonStr
LOCAL oResp

nSuccess := 0

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  Note: Ebay provides a Key Management API
//  See https://developer.ebay.com/api-docs/developer/key-management/overview.html

//  The following test keys can be used: 
//  
//  Ed25519 
//  
//  Private Key:
//  
//  -----BEGIN PRIVATE KEY-----
//  MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
//  -----END PRIVATE KEY-----

cStrPrivateKey := "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF"

//  Public Key:
//  
//  -----BEGIN PUBLIC KEY-----
//  MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
//  -----END PUBLIC KEY-----

cStrPublicKey := "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs="

//  This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
//  This JWE is just for example:
cStrJwe := "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw"

oSbBody := CreateObject("Chilkat.StringBuilder")
oSbBody:Append('{"hello": "world"}')

? "Body of request:"
? oSbBody:GetAsString()

//  -------------------------------------------------
//  Build the signature base string...

oSbSigBase := CreateObject("Chilkat.StringBuilder")

oSbSigBase:Append('"content-digest": sha-256=:')
oSbSigBase:Append(oSbBody:GetHash("sha256", "base64", "utf-8"))
oSbSigBase:Append(":" + Chr(10))

oSbSigBase:Append('"x-ebay-signature-key": ')
oSbSigBase:Append(cStrJwe)
oSbSigBase:Append(Chr(10))

oSbSigBase:Append('"@method": POST' + Chr(10))

//  This is the path part of the URL without query params...
oSbSigBase:Append('"@path": ')
oSbSigBase:Append("/verifysignature")
oSbSigBase:Append(Chr(10))

//  The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
//  In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
//  Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
oSbSigBase:Append('"@authority": ')
oSbSigBase:Append("localhost:8080")
oSbSigBase:Append(Chr(10))

oSbSigBase:Append('"@signature-params": ')

oSbSigInput := CreateObject("Chilkat.StringBuilder")
oSbSigInput:Append('("content-digest" "x-ebay-signature-key" "@method" "@path" "@authority")')
oSbSigInput:Append(";created=")

oDt := CreateObject("Chilkat.CkDateTime")
oDt:SetFromCurrentSystemTime()
cUnixTimeNow := oDt:GetAsUnixTimeStr(0)
oSbSigInput:Append(cUnixTimeNow)

oSbSigBase:AppendSb(oSbSigInput)

//  -------------------------------------------------
//  Sign the signature base string using the Ed25519 private key

oBdPrivKey := CreateObject("Chilkat.BinData")
oBdPrivKey:AppendEncoded(cStrPrivateKey, "base64")

oPrivKey := CreateObject("Chilkat.PrivateKey")
nSuccess := oPrivKey:LoadAnyFormat(oBdPrivKey, "")
IF (nSuccess == 0)
    ? oPrivKey:LastErrorText
    oSbBody:destroy()
    oSbSigBase:destroy()
    oSbSigInput:destroy()
    oDt:destroy()
    oBdPrivKey:destroy()
    oPrivKey:destroy()
    RETURN
ENDIF

oBdToBeSigned := CreateObject("Chilkat.BinData")
oBdToBeSigned:AppendSb(oSbSigBase, "utf-8")

oEddsa := CreateObject("Chilkat.EdDSA")
cSigBase64 := oEddsa:SignBdENC(oBdToBeSigned, "base64", oPrivKey)
IF (oEddsa:LastMethodSuccess == 0)
    ? oEddsa:LastErrorText
    oSbBody:destroy()
    oSbSigBase:destroy()
    oSbSigInput:destroy()
    oDt:destroy()
    oBdPrivKey:destroy()
    oPrivKey:destroy()
    oBdToBeSigned:destroy()
    oEddsa:destroy()
    RETURN
ENDIF

? "sigBase64:"
? cSigBase64

//  ----------------------------------------------------------
//  Send the JSON POST

oHttp := CreateObject("Chilkat.Http")

oHttp:SetRequestHeader("x-ebay-signature-key", cStrJwe)

oSbContentDigestHdr := CreateObject("Chilkat.StringBuilder")
oSbContentDigestHdr:Append("sha-256=:")
oSbContentDigestHdr:Append(oSbBody:GetHash("sha256", "base64", "utf-8"))
oSbContentDigestHdr:Append(":")
oHttp:SetRequestHeader("Content-Digest", oSbContentDigestHdr:GetAsString())

oSbSigHdr := CreateObject("Chilkat.StringBuilder")
oSbSigHdr:Append("sig1=:")
oSbSigHdr:Append(cSigBase64)
oSbSigHdr:Append(":")
oHttp:SetRequestHeader("Signature", oSbSigHdr:GetAsString())

oSbSigInput:Prepend("sig1=")
oHttp:SetRequestHeader("Signature-Input", oSbSigInput:GetAsString())

//  Add this header to make eBay actually check the signature.
oHttp:SetRequestHeader("x-ebay-enforce-signature", "true")

//  Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
oHttp:AuthToken := "your_oauth2_access_token"

//  The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
//  Normally, you'll send your POST to some api.ebay.com endpoint.
cUrl := "http://localhost:8080/verifysignature"

cJsonStr := oSbBody:GetAsString()
oResp := CreateObject("Chilkat.HttpResponse")
nSuccess := oHttp:HttpStr("POST", "http://localhost:8080/verifysignature", cJsonStr, "utf-8", "application/json", oResp)
IF (nSuccess == 0)
    ? oHttp:LastErrorText
    oSbBody:destroy()
    oSbSigBase:destroy()
    oSbSigInput:destroy()
    oDt:destroy()
    oBdPrivKey:destroy()
    oPrivKey:destroy()
    oBdToBeSigned:destroy()
    oEddsa:destroy()
    oHttp:destroy()
    oSbContentDigestHdr:destroy()
    oSbSigHdr:destroy()
    oResp:destroy()
    RETURN
ENDIF

? "Response status code: " + Str(oResp:StatusCode)
? "Response body:"
? oResp:BodyStr

oSbBody:destroy()
oSbSigBase:destroy()
oSbSigInput:destroy()
oDt:destroy()
oBdPrivKey:destroy()
oPrivKey:destroy()
oBdToBeSigned:destroy()
oEddsa:destroy()
oHttp:destroy()
oSbContentDigestHdr:destroy()
oSbSigHdr:destroy()
oResp:destroy()