tokenly/hmac-auth

HMAC authentication for Tokenly APIs

Overview

The HMAC authentication component for Tokenly., _(*1)

, _(*2)

Authentication

To authenticate HTTP requests that use this component, you must include 3 HTTP headers with your request:, _(*3)

1. X-Tokenly-Auth-Api-Token
2. X-Tokenly-Auth-Nonce
3. X-Tokenly-Auth-Signature

To generate these headers, you will need an API Token and a secret API Key., _(*4)

Say my API Token is TWKTkwIQDTvirh6D and my API Secret key is Kun2M2UladalYAeUvXyiKWhFuwrsmSreM841K45O. Here is an explanation of each header., _(*5)

X-Tokenly-Auth-Api-Token

This token is nothing more than the API Token., _(*6)

Example: X-Tokenly-Auth-Api-Token: TWKTkwIQDTvirh6D, _(*7)

X-Tokenly-Auth-Nonce

The nonce header is the current unix timestamp in seconds., _(*8)

Example: X-Tokenly-Auth-Nonce: 1457530047, _(*9)

X-Tokenly-Auth-Signature

The signature is a base64 encoded string using sha256 HMAC. The key for the hash is the API Key. And the message is generated using the following data:, _(*10)

{METHOD}\n
{URL}\n
{PARAMETERS}\n
{API TOKEN}\n
{NONCE}

{METHOD} is the http method such as GET,POST,PUT,DELETE {URL} is the full URL of the api endpoint {PARAMETERS} are required and should be a JSON encoded string representing the parameters. For empty parameters, use {}. {API TOKEN} and {NONCE} are the same as send in the headers., _(*11)

Items are separated with a single newline character., _(*12)

After calculating the HMAC, encode the data in base64 format., _(*13)

Example:, _(*14)

Using the values above and a request of GET https://www.example.com/api/v1/mystuff, the signature header will be:, _(*15)

X-Tokenly-Auth-Signature: hZ6SDgcZzo5AYrS9yopEQo068ax0NojG/CfXWG+RJEA, _(*16)