SQL Server

Xero 2 Legged OAuth for Private Application

This example demonstrates the REST object for 2-legged OAuth for a private application.

An application can setup OAuth1 for a given instance of the Chilkat REST object, and then use the instance for many REST API calls. This example demonstrates the OAuth1 setup and initial connection. This code would typically be placed in a subroutine/function to "initalize" the REST object before beginning to use it for REST HTTP requests.

Note: Xero private applications use 2 legged OAuth and bypass the user authorization workflow in the standard OAuth process. Private applications are linked to a single Xero organisation which is chosen when you register your application. In summary: 2-legged OAuth1 is for applications that access the data that they themselves own.

SQL Server

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    -- This sample code would typically be placed in a subroutine or function
    -- where the rest object is passed by reference.
    -- It does the OAuth1 setup and makes the initial connection.
    DECLARE @rest int
    EXEC @hr = sp_OACreate 'Chilkat.Rest', @rest OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @consumerKey nvarchar(4000)
    SELECT @consumerKey = 'XERO_PRIVATE_APP_KEY'
    DECLARE @consumerSecret nvarchar(4000)
    SELECT @consumerSecret = 'XERO_PRIVATE_APP_SECRET'

    -- Let's get our private key from our PFX (password protected), or the PEM (unprotected).
    -- You can decide which to use.  Either is OK, although I would recommend keeping your
    -- private keys in a PFX and not in an unprotected PEM.
    DECLARE @pfx int
    EXEC @hr = sp_OACreate 'Chilkat.Pfx', @pfx OUT

    EXEC sp_OAMethod @pfx, 'LoadPfxFile', @success OUT, 'qa_data/certs/xero_private_app/public_privatekey.pfx', 'PFX_PASSWORD'
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @pfx, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @rest
        EXEC @hr = sp_OADestroy @pfx
        RETURN
      END

    DECLARE @privKeyFromPfx int
    EXEC @hr = sp_OACreate 'Chilkat.PrivateKey', @privKeyFromPfx OUT

    EXEC sp_OAMethod @pfx, 'PrivateKeyAt', @success OUT, 0, @privKeyFromPfx
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @pfx, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @rest
        EXEC @hr = sp_OADestroy @pfx
        EXEC @hr = sp_OADestroy @privKeyFromPfx
        RETURN
      END

    -- Or we can load from a PEM..
    DECLARE @privKeyFromPem int
    EXEC @hr = sp_OACreate 'Chilkat.PrivateKey', @privKeyFromPem OUT

    EXEC sp_OAMethod @privKeyFromPem, 'LoadPemFile', @success OUT, 'qa_data/certs/xero_private_app/privatekey.pem'
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @privKeyFromPem, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @rest
        EXEC @hr = sp_OADestroy @pfx
        EXEC @hr = sp_OADestroy @privKeyFromPfx
        EXEC @hr = sp_OADestroy @privKeyFromPem
        RETURN
      END

    -- Note: There are many other means for loading a private key, including
    -- from other formats and directly from memory (i.e. not file-based).

    DECLARE @oauth1 int
    EXEC @hr = sp_OACreate 'Chilkat.OAuth1', @oauth1 OUT

    EXEC sp_OASetProperty @oauth1, 'ConsumerKey', @consumerKey
    EXEC sp_OASetProperty @oauth1, 'ConsumerSecret', @consumerSecret
    EXEC sp_OASetProperty @oauth1, 'Token', @consumerKey
    EXEC sp_OASetProperty @oauth1, 'TokenSecret', @consumerSecret
    EXEC sp_OASetProperty @oauth1, 'SignatureMethod', 'RSA-SHA1'
    EXEC sp_OAMethod @oauth1, 'SetRsaKey', @success OUT, @privKeyFromPfx

    -- Make the initial connection.
    -- A single REST object, once connected, can be used for many Xero REST API calls.
    -- The auto-reconnect indicates that if the already-established HTTPS connection is closed,
    -- then it will be automatically re-established as needed.
    DECLARE @bAutoReconnect int
    SELECT @bAutoReconnect = 1
    EXEC sp_OAMethod @rest, 'Connect', @success OUT, 'api.xero.com', 443, 1, @bAutoReconnect
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @rest, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @rest
        EXEC @hr = sp_OADestroy @pfx
        EXEC @hr = sp_OADestroy @privKeyFromPfx
        EXEC @hr = sp_OADestroy @privKeyFromPem
        EXEC @hr = sp_OADestroy @oauth1
        RETURN
      END

    -- Finally, install the OAuth1 authenticator.
    -- (It make no difference whether this happens before or after the
    -- connection is established.)
    EXEC sp_OAMethod @rest, 'SetAuthOAuth1', @success OUT, @oauth1, 0


    PRINT 'OK, the Xero OAuth1 is initialized and the REST object is ready to make REST API calls..'

    EXEC @hr = sp_OADestroy @rest
    EXEC @hr = sp_OADestroy @pfx
    EXEC @hr = sp_OADestroy @privKeyFromPfx
    EXEC @hr = sp_OADestroy @privKeyFromPem
    EXEC @hr = sp_OADestroy @oauth1


END
GO