Zig Requires Chilkat v11.0.0+
Zig
ebay: Add Digital Signature to HTTP Request
See more eBay Examples
Demonstrates how to add a digital signature to an ebay HTTP request.Chilkat Zig Downloads
const std = @import("std");
const chilkat = @import("chilkat");
pub fn main(init: std.process.Init) !void {
const alloc = init.arena.allocator();
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.
// Note: Ebay provides a Key Management API
// See https://developer.ebay.com/api-docs/developer/key-management/overview.html
// The following test keys can be used:
//
// Ed25519
//
// Private Key:
//
// -----BEGIN PRIVATE KEY-----
// MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
// -----END PRIVATE KEY-----
const str_private_key = "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF";
// Public Key:
//
// -----BEGIN PUBLIC KEY-----
// MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
// -----END PUBLIC KEY-----
// This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
// This JWE is just for example:
const str_jwe = "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw";
const sb_body = try chilkat.StringBuilder.init();
defer sb_body.deinit();
sb_body.append("{\"hello\": \"world\"}") catch {};
std.debug.print("Body of request:\n", .{});
std.debug.print("{s}\n", .{try sb_body.getAsString(alloc)});
// -------------------------------------------------
// Build the signature base string...
const sb_sig_base = try chilkat.StringBuilder.init();
defer sb_sig_base.deinit();
sb_sig_base.append("\"content-digest\": sha-256=:") catch {};
sb_sig_base.append(try sb_body.getHash(alloc, "sha256", "base64", "utf-8")) catch {};
sb_sig_base.append(":\n") catch {};
sb_sig_base.append("\"x-ebay-signature-key\": ") catch {};
sb_sig_base.append(str_jwe) catch {};
sb_sig_base.append("\n") catch {};
sb_sig_base.append("\"@method\": POST\n") catch {};
// This is the path part of the URL without query params...
sb_sig_base.append("\"@path\": ") catch {};
sb_sig_base.append("/verifysignature") catch {};
sb_sig_base.append("\n") catch {};
// The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
// In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
// Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
sb_sig_base.append("\"@authority\": ") catch {};
sb_sig_base.append("localhost:8080") catch {};
sb_sig_base.append("\n") catch {};
sb_sig_base.append("\"@signature-params\": ") catch {};
const sb_sig_input = try chilkat.StringBuilder.init();
defer sb_sig_input.deinit();
sb_sig_input.append("(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")") catch {};
sb_sig_input.append(";created=") catch {};
const dt = try chilkat.DateTime.init();
defer dt.deinit();
dt.setFromCurrentSystemTime() catch {};
const unix_time_now = try dt.getAsUnixTimeStr(alloc, false);
sb_sig_input.append(unix_time_now) catch {};
sb_sig_base.appendSb(sb_sig_input) catch {};
// -------------------------------------------------
// Sign the signature base string using the Ed25519 private key
const bd_priv_key = try chilkat.BinData.init();
defer bd_priv_key.deinit();
bd_priv_key.appendEncoded(str_private_key, "base64") catch {};
const priv_key = try chilkat.PrivateKey.init();
defer priv_key.deinit();
priv_key.loadAnyFormat(bd_priv_key, "") catch {
std.debug.print("{s}\n", .{try priv_key.getLastErrorText(alloc)});
return;
};
const bd_to_be_signed = try chilkat.BinData.init();
defer bd_to_be_signed.deinit();
bd_to_be_signed.appendSb(sb_sig_base, "utf-8") catch {};
const eddsa = try chilkat.EdDSA.init();
defer eddsa.deinit();
const sig_base64 = eddsa.signBdENC(alloc, bd_to_be_signed, "base64", priv_key) catch {
std.debug.print("{s}\n", .{try eddsa.getLastErrorText(alloc)});
return;
};
std.debug.print("sigBase64:\n", .{});
std.debug.print("{s}\n", .{sig_base64});
// ----------------------------------------------------------
// Send the JSON POST
const http = try chilkat.Http.init();
defer http.deinit();
http.setRequestHeader("x-ebay-signature-key", str_jwe);
const sb_content_digest_hdr = try chilkat.StringBuilder.init();
defer sb_content_digest_hdr.deinit();
sb_content_digest_hdr.append("sha-256=:") catch {};
sb_content_digest_hdr.append(try sb_body.getHash(alloc, "sha256", "base64", "utf-8")) catch {};
sb_content_digest_hdr.append(":") catch {};
http.setRequestHeader("Content-Digest", try sb_content_digest_hdr.getAsString(alloc));
const sb_sig_hdr = try chilkat.StringBuilder.init();
defer sb_sig_hdr.deinit();
sb_sig_hdr.append("sig1=:") catch {};
sb_sig_hdr.append(sig_base64) catch {};
sb_sig_hdr.append(":") catch {};
http.setRequestHeader("Signature", try sb_sig_hdr.getAsString(alloc));
sb_sig_input.prepend("sig1=") catch {};
http.setRequestHeader("Signature-Input", try sb_sig_input.getAsString(alloc));
// Add this header to make eBay actually check the signature.
http.setRequestHeader("x-ebay-enforce-signature", "true");
// Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
http.setAuthToken("your_oauth2_access_token");
// The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
// Normally, you'll send your POST to some api.ebay.com endpoint.
const json_str = try sb_body.getAsString(alloc);
const resp = try chilkat.HttpResponse.init();
defer resp.deinit();
http.httpStr("POST", "http://localhost:8080/verifysignature", json_str, "utf-8", "application/json", resp) catch {
std.debug.print("{s}\n", .{try http.getLastErrorText(alloc)});
return;
};
std.debug.print("Response status code: {d}\n", .{resp.getStatusCode()});
std.debug.print("Response body:\n", .{});
std.debug.print("{s}\n", .{try resp.getBodyStr(alloc)});
}