Signing requests

PHP

<?php
$keyId  = getenv('API_KEY_ID');
$secret = getenv('API_SECRET');

function signedRequest(string $method, string $url, ?array $payload = null): array
{
    global $keyId, $secret;

    $body      = $payload === null ? '' : json_encode($payload);
    $timestamp = (string) time();
    $nonce     = bin2hex(random_bytes(16));
    $path      = ltrim(parse_url($url, PHP_URL_PATH), '/');

    $canonical = implode('.', [strtoupper($method), $path, $timestamp, $nonce, hash('sha256', $body)]);
    $signature = hash_hmac('sha256', $canonical, $secret);

    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST  => strtoupper($method),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_POSTFIELDS     => $body === '' ? null : $body,
        CURLOPT_HTTPHEADER     => [
            'Content-Type: application/json',
            'X-Key-Id: ' . $keyId,
            'X-Timestamp: ' . $timestamp,
            'X-Nonce: ' . $nonce,
            'X-Signature: ' . $signature,
            'Idempotency-Key: ' . bin2hex(random_bytes(16)),
        ],
    ]);
    $response = curl_exec($ch);
    curl_close($ch);

    return json_decode($response, true);
}

$balance = signedRequest('GET', 'https://afropin.com/api/v1/reseller/wallets');

Node.js

const crypto = require('crypto');

const keyId = process.env.API_KEY_ID;
const secret = process.env.API_SECRET;

async function signedRequest(method, url, payload) {
  // Sign and send the same string: never re-serialize the body after hashing it
  const body = payload === undefined ? '' : JSON.stringify(payload);
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const nonce = crypto.randomBytes(16).toString('hex');
  const path = new URL(url).pathname.replace(/^\//, '');

  const bodyHash = crypto.createHash('sha256').update(body).digest('hex');
  const canonical = [method.toUpperCase(), path, timestamp, nonce, bodyHash].join('.');
  const signature = crypto.createHmac('sha256', secret).update(canonical).digest('hex');

  const res = await fetch(url, {
    method,
    body: body || undefined,
    headers: {
      'Content-Type': 'application/json',
      'X-Key-Id': keyId,
      'X-Timestamp': timestamp,
      'X-Nonce': nonce,
      'X-Signature': signature,
      'Idempotency-Key': crypto.randomUUID(),
    },
  });
  return res.json();
}

signedRequest('GET', 'https://afropin.com/api/v1/reseller/wallets').then(console.log);

Python

import hashlib, hmac, json, os, secrets, time, uuid
from urllib.parse import urlparse
import requests

KEY_ID = os.environ["API_KEY_ID"]
SECRET = os.environ["API_SECRET"]

def signed_request(method, url, payload=None):
    # Send the exact bytes you hashed: pass data=body, not json=payload
    body = "" if payload is None else json.dumps(payload)
    timestamp = str(int(time.time()))
    nonce = secrets.token_hex(16)
    path = urlparse(url).path.lstrip("/")

    body_hash = hashlib.sha256(body.encode()).hexdigest()
    canonical = ".".join([method.upper(), path, timestamp, nonce, body_hash])
    signature = hmac.new(SECRET.encode(), canonical.encode(), hashlib.sha256).hexdigest()

    return requests.request(method, url, data=body or None, headers={
        "Content-Type": "application/json",
        "X-Key-Id": KEY_ID,
        "X-Timestamp": timestamp,
        "X-Nonce": nonce,
        "X-Signature": signature,
        "Idempotency-Key": str(uuid.uuid4()),
    }).json()

print(signed_request("GET", "https://afropin.com/api/v1/reseller/wallets"))

cURL

KEY_ID="apk_..."
SECRET="..."
URL="https://afropin.com/api/v1/reseller/wallets"
SIGN_PATH="api/v1/reseller/wallets"

TIMESTAMP=$(date +%s)
NONCE=$(openssl rand -hex 16)
BODY_HASH=$(printf '' | openssl dgst -sha256 | awk '{print $NF}')
SIGNATURE=$(printf '%s' "GET.$SIGN_PATH.$TIMESTAMP.$NONCE.$BODY_HASH" \
  | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $NF}')

curl -X GET "$URL" \
  -H "Content-Type: application/json" \
  -H "X-Key-Id: $KEY_ID" \
  -H "X-Timestamp: $TIMESTAMP" \
  -H "X-Nonce: $NONCE" \
  -H "X-Signature: $SIGNATURE" \
  -H "Idempotency-Key: $(uuidgen)"