B4X Requires Chilkat v11.0.0+
B4X
ebay: Add Digital Signature to HTTP Request
See more eBay Examples
Demonstrates how to add a digital signature to an ebay HTTP request.Chilkat B4X Downloads
Dim success As Boolean = False
' This example requires the Chilkat API to have been previously unlocked.
' See Global Unlock Sample for sample code.
' Note: Ebay provides a Key Management API
' See https://developer.ebay.com/api-docs/developer/key-management/overview.html
' The following test keys can be used:
'
' Ed25519
'
' Private Key:
'
' -----BEGIN PRIVATE KEY-----
' MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
' -----END PRIVATE KEY-----
Dim strPrivateKey As String = "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF"
' Public Key:
'
' -----BEGIN PUBLIC KEY-----
' MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
' -----END PUBLIC KEY-----
Dim strPublicKey As String = "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs="
' This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
' This JWE is just for example:
Dim strJwe As String = "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw"
Dim sbBody As ChilkatStringBuilder
sbBody.Initialize
sbBody.Append("{" & Chr(34) & "hello" & Chr(34) & ": " & Chr(34) & "world" & Chr(34) & "}")
Log("Body of request:")
Log(sbBody.GetAsString)
' -------------------------------------------------
' Build the signature base string...
Dim sbSigBase As ChilkatStringBuilder
sbSigBase.Initialize
sbSigBase.Append(Chr(34) & "content-digest" & Chr(34) & ": sha-256=:")
sbSigBase.Append(sbBody.GetHash("sha256", "base64", "utf-8"))
sbSigBase.Append(":" & Chr(10))
sbSigBase.Append(Chr(34) & "x-ebay-signature-key" & Chr(34) & ": ")
sbSigBase.Append(strJwe)
sbSigBase.Append(Chr(10))
sbSigBase.Append(Chr(34) & "@method" & Chr(34) & ": POST" & Chr(10))
' This is the path part of the URL without query params...
sbSigBase.Append(Chr(34) & "@path" & Chr(34) & ": ")
sbSigBase.Append("/verifysignature")
sbSigBase.Append(Chr(10))
' The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
' In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
' Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
sbSigBase.Append(Chr(34) & "@authority" & Chr(34) & ": ")
sbSigBase.Append("localhost:8080")
sbSigBase.Append(Chr(10))
sbSigBase.Append(Chr(34) & "@signature-params" & Chr(34) & ": ")
Dim sbSigInput As ChilkatStringBuilder
sbSigInput.Initialize
sbSigInput.Append("(" & Chr(34) & "content-digest" & Chr(34) & " " & Chr(34) & "x-ebay-signature-key" & Chr(34) & " " & Chr(34) & "@method" & Chr(34) & " " & Chr(34) & "@path" & Chr(34) & " " & Chr(34) & "@authority" & Chr(34) & ")")
sbSigInput.Append(";created=")
Dim dt As ChilkatDateTime
dt.Initialize
dt.SetFromCurrentSystemTime
Dim unixTimeNow As String = dt.GetAsUnixTimeStr(False)
sbSigInput.Append(unixTimeNow)
sbSigBase.AppendSb(sbSigInput)
' -------------------------------------------------
' Sign the signature base string using the Ed25519 private key
Dim bdPrivKey As ChilkatBinData
bdPrivKey.Initialize
bdPrivKey.AppendEncoded(strPrivateKey, "base64")
Dim privKey As ChilkatPrivateKey
privKey.Initialize("privKey")
success = privKey.LoadAnyFormat(bdPrivKey, "")
If success = False Then
Log(privKey.LastErrorText)
Return
End If
Dim bdToBeSigned As ChilkatBinData
bdToBeSigned.Initialize
bdToBeSigned.AppendSb(sbSigBase, "utf-8")
Dim eddsa As ChilkatEdDSA
eddsa.Initialize
Dim sigBase64 As String = eddsa.SignBdENC(bdToBeSigned, "base64", privKey)
If eddsa.LastMethodSuccess = False Then
Log(eddsa.LastErrorText)
Return
End If
Log("sigBase64:")
Log(sigBase64)
' ----------------------------------------------------------
' Send the JSON POST
Dim http As ChilkatHttp
http.Initialize("http")
http.SetRequestHeader("x-ebay-signature-key", strJwe)
Dim sbContentDigestHdr As ChilkatStringBuilder
sbContentDigestHdr.Initialize
sbContentDigestHdr.Append("sha-256=:")
sbContentDigestHdr.Append(sbBody.GetHash("sha256", "base64", "utf-8"))
sbContentDigestHdr.Append(":")
http.SetRequestHeader("Content-Digest", sbContentDigestHdr.GetAsString)
Dim sbSigHdr As ChilkatStringBuilder
sbSigHdr.Initialize
sbSigHdr.Append("sig1=:")
sbSigHdr.Append(sigBase64)
sbSigHdr.Append(":")
http.SetRequestHeader("Signature", sbSigHdr.GetAsString)
sbSigInput.Prepend("sig1=")
http.SetRequestHeader("Signature-Input", sbSigInput.GetAsString)
' Add this header to make eBay actually check the signature.
http.SetRequestHeader("x-ebay-enforce-signature", "true")
' Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
http.AuthToken = "your_oauth2_access_token"
' The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
' Normally, you'll send your POST to some api.ebay.com endpoint.
Dim url As String = "http://localhost:8080/verifysignature"
Dim jsonStr As String = sbBody.GetAsString
Dim resp As ChilkatHttpResponse
resp.Initialize
success = http.HttpStr("POST", "http://localhost:8080/verifysignature", jsonStr, "utf-8", "application/json", resp)
If success = False Then
Log(http.LastErrorText)
Return
End If
Log("Response status code: " & resp.StatusCode)
Log("Response body:")
Log(resp.BodyStr)