Lua Requires Chilkat v11.0.0+

ING Open Banking OAuth2 Client Credentials

See more OAuth2 Examples

Demonstrates how to get an access token for the ING Open Banking APIs using client credentials. Lua

local chilkat = require("chilkat")

-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local cert = chilkat.Cert.new()
local success = cert:load_from_file("qa_data/certs_and_keys/ING/example_client_tls.cer")
if not success then
    print(cert.last_error_text)
    return
end

local bdPrivKey = chilkat.BinData.new()
success = bdPrivKey:load_file("qa_data/certs_and_keys/ING/example_client_tls.key")
if not success then
    print("Failed to load example_client_tls.key")
    return
end

-- The OAuth 2.0 client_id for these certificates is e77d776b-90af-4684-bebc-521e5b2614dd.
-- Please note down this client_id since you will need it in the next steps to call the API.

local privKey = chilkat.PrivateKey.new()
success = privKey:load_any_format(bdPrivKey, "")
if not success then
    print(privKey.last_error_text)
    return
end

-- Associate the private key with the certificate.
success = cert:set_private_key(privKey)
if not success then
    print(cert.last_error_text)
    return
end

local http = chilkat.Http.new()

success = http:set_ssl_client_cert(cert)
if not success then
    print(http.last_error_text)
    return
end

-- Calculate the Digest and add the "Digest" header.  Do the equivalent of this:
-- payload="grant_type=client_credentials"
-- payloadDigest=`echo -n "$payload" | openssl dgst -binary -sha256 | openssl base64`
-- digest=SHA-256=$payloadDigest
local crypt = chilkat.Crypt2.new()
crypt.hash_algorithm = "SHA256"
crypt.encoding_mode = "base64"
local payload = "grant_type=client_credentials"
local payloadDigest = crypt:hash_string_enc(payload)

-- Calculate the current date/time and add the Date header.
-- reqDate=$(LC_TIME=en_US.UTF-8 date -u "+%a, %d %b %Y %H:%M:%S GMT")
local dt = chilkat.DateTime.new()
dt:set_from_current_system_time()
-- The desire date/time format is the "RFC822" format.
http:set_request_header("Date", dt:get_as_rfc822(false))

-- Calculate signature for signing your request
-- Duplicate the following code:

--     httpMethod="post"
--     reqPath="/oauth2/token"
--     signingString="(request-target): $httpMethod $reqPath
--     date: $reqDate
--     digest: $digest"
--     signature=`printf "$signingString" | openssl dgst -sha256 -sign "${certPath}example_client_signing.key" -passin "pass:changeit" | openssl base64 -A`

local httpMethod = "POST"
local reqPath = "/oauth2/token"

local sbStringToSign = chilkat.StringBuilder.new()
sbStringToSign:append("(request-target): ")
sbStringToSign:append(httpMethod)
sbStringToSign:to_lowercase()
sbStringToSign:append(" ")
sbStringToSign:append_line(reqPath, false)

sbStringToSign:append("date: ")
sbStringToSign:append_line(dt:get_as_rfc822(false), false)

sbStringToSign:append("digest: SHA-256=")
sbStringToSign:append(payloadDigest)

local signingPrivKey = chilkat.PrivateKey.new()
success = signingPrivKey:load_pem_file("qa_data/certs_and_keys/ING/example_client_signing.key")
if not success then
    print(signingPrivKey.last_error_text)
    return
end

local rsa = chilkat.Rsa.new()
success = rsa:use_private_key(signingPrivKey)
if not success then
    print(rsa.last_error_text)
    return
end

rsa.encoding_mode = "base64"
local b64Signature = rsa:sign_string_enc(sbStringToSign:get_as_string(), "SHA256")

local sbAuthHdrVal = chilkat.StringBuilder.new()
sbAuthHdrVal:append("Signature keyId=\"e77d776b-90af-4684-bebc-521e5b2614dd\",")
sbAuthHdrVal:append("algorithm=\"rsa-sha256\",")
sbAuthHdrVal:append("headers=\"(request-target) date digest\",")
sbAuthHdrVal:append("signature=\"")
sbAuthHdrVal:append(b64Signature)
sbAuthHdrVal:append("\"")

local sbDigestHdrVal = chilkat.StringBuilder.new()
sbDigestHdrVal:append("SHA-256=")
sbDigestHdrVal:append(payloadDigest)

-- Do the following CURL statement:

--     curl -i -X POST "${httpHost}${reqPath}" \
--     -H 'Accept: application/json' \
--     -H 'Content-Type: application/x-www-form-urlencoded' \
--     -H "Digest: ${digest}" \
--     -H "Date: ${reqDate}" \
--     -H "authorization: Signature keyId=\"$keyId\",algorithm=\"rsa-sha256\",headers=\"(request-target) date digest\",signature=\"$signature\"" \
--     -d "${payload}" \
--     --cert "${certPath}tlsCert.crt" \
--     --key "${certPath}tlsCert.key"

local req = chilkat.HttpRequest.new()
req:add_param("grant_type", "client_credentials")
req:add_header("Accept", "application/json")
req:add_header("Date", dt:get_as_rfc822(false))
req:add_header("Digest", sbDigestHdrVal:get_as_string())
req:add_header("Authorization", sbAuthHdrVal:get_as_string())

req.http_verb = "POST"
req.content_type = "application/x-www-form-urlencoded"

local resp = chilkat.HttpResponse.new()
success = http:http_req("https://api.sandbox.ing.com/oauth2/token", req, resp)
if not success then
    print(http.last_error_text)
    return
end

-- If successful, the status code = 200
print("Response Status Code: " .. resp.status_code)
print(resp.body_str)

local json = chilkat.JsonObject.new()
json:load(resp.body_str)

json.emit_compact = false
print(json:emit())

-- A successful response contains an access token such as:
-- {
--   "access_token": "eyJhbGc ... bxI_SoPOBH9xmoM",
--   "expires_in": 905,
--   "scope": "payment-requests:view payment-requests:create payment-requests:close greetings:view virtual-ledger-accounts:fund-reservation:create virtual-ledger-accounts:fund-reservation:delete virtual-ledger-accounts:balance:view",
--   "token_type": "Bearer",
--   "keys": [
--     {
--       "kty": "RSA",
--       "n": "3l3rdz4...04VPkdV",
--       "e": "AQAB",
--       "use": "sig",
--       "alg": "RS256",
--       "x5t": "3c396700fc8cd709cf9cb5452a22bcde76985851"
--     }
--   ],
--   "client_id": "e77d776b-90af-4684-bebc-521e5b2614dd"
-- }

-- Use this online tool to generate parsing code from sample JSON:
-- Generate Parsing Code from JSON

local kty = ""
local n = ""
local e = ""
local use = ""
local alg = ""
local x5t = ""

local access_token = json:string_of("access_token")
local expires_in = json:int_of("expires_in")
local scope = json:string_of("scope")
local token_type = json:string_of("token_type")
local client_id = json:string_of("client_id")
local i = 0
local count_i = json:size_of_array("keys")
while i < count_i do
    json.i = i
    kty = json:string_of("keys[i].kty")
    n = json:string_of("keys[i].n")
    e = json:string_of("keys[i].e")
    use = json:string_of("keys[i].use")
    alg = json:string_of("keys[i].alg")
    x5t = json:string_of("keys[i].x5t")
    i = i + 1
end

-- This example will save the JSON containing the access key to a file so that
-- a subsequent example can load it and then use the access key for a request, such as to create a payment request.
json:write_file("qa_data/tokens/ing_access_token.json")