Signing requests

$sig = Time2payClient::sign('test-secret', 1700000000, '0123456789abcdef0123456789abcdef', 'POST', '/v1/hpp/sessions',
    '{"player_id":"player-123","external_order_id":"deposit-1001"}');
var_dump($sig === 'aec82eccaa5a1e4729606faf61e67486f78fe0a5b155374fd6672690cb3339ae');

const sig = await sign("test-secret", 1700000000, "0123456789abcdef0123456789abcdef", "POST", "/v1/hpp/sessions",
  '{"player_id":"player-123","external_order_id":"deposit-1001"}');
console.log(sig === "aec82eccaa5a1e4729606faf61e67486f78fe0a5b155374fd6672690cb3339ae");

sig = sign("test-secret", 1700000000, "0123456789abcdef0123456789abcdef", "POST", "/v1/hpp/sessions",
           b'{"player_id":"player-123","external_order_id":"deposit-1001"}')
print(sig == "aec82eccaa5a1e4729606faf61e67486f78fe0a5b155374fd6672690cb3339ae")

const sig = sign("test-secret", 1700000000, "0123456789abcdef0123456789abcdef", "POST", "/v1/hpp/sessions",
  '{"player_id":"player-123","external_order_id":"deposit-1001"}');
console.log(sig === "aec82eccaa5a1e4729606faf61e67486f78fe0a5b155374fd6672690cb3339ae");

<?php

final class Time2payError extends RuntimeException
{
    public function __construct(public readonly int $status, public readonly array $error)
    {
        parent::__construct(sprintf('%d %s: %s', $status, $error['code'] ?? 'http_error', $error['message'] ?? ''));
    }

    public function errorCode(): string
    {
        return $this->error['code'] ?? '';
    }

    public function details(): array
    {
        return $this->error['details'] ?? [];
    }
}

final class Time2payClient
{
    public function __construct(
        private readonly string $baseUrl,
        private readonly string $keyId,
        private readonly string $secret,
    ) {
    }

    public static function sign(string $secret, int $ts, string $nonce, string $method, string $path, string $body): string
    {
        $canonical = implode("\n", [$ts, $nonce, strtoupper($method), $path, hash('sha256', $body)]);
        return hash_hmac('sha256', $canonical, $secret);
    }

    public function call(string $method, string $path, ?array $payload = null): array
    {
        $body = $payload === null ? '' : json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR);
        $ts = time();
        $nonce = bin2hex(random_bytes(16));
        $headers = [
            'X-Api-Key: ' . $this->keyId,
            'X-Timestamp: ' . $ts,
            'X-Nonce: ' . $nonce,
            'X-Signature: ' . self::sign($this->secret, $ts, $nonce, $method, $path, $body),
        ];
        if ($body !== '') {
            $headers[] = 'Content-Type: application/json';
        }

        $ch = curl_init($this->baseUrl . $path);
        curl_setopt_array($ch, [
            CURLOPT_CUSTOMREQUEST => strtoupper($method),
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HTTPHEADER => $headers,
            CURLOPT_TIMEOUT => 30,
        ]);
        if ($body !== '') {
            curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
        }
        $response = curl_exec($ch);
        if ($response === false) {
            throw new RuntimeException(curl_error($ch));
        }
        $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
        $data = json_decode($response, true) ?? [];
        if ($status >= 300) {
            throw new Time2payError($status, $data['error'] ?? []);
        }
        return $data;
    }
}

const encoder = new TextEncoder();

function toHex(bytes) {
  return Array.from(new Uint8Array(bytes), (b) => b.toString(16).padStart(2, "0")).join("");
}

export class Time2payError extends Error {
  constructor(status, error = {}) {
    super(`${status} ${error.code ?? "http_error"}: ${error.message ?? ""}`);
    this.status = status;
    this.code = error.code;
    this.details = error.details ?? {};
  }
}

export async function sign(secret, ts, nonce, method, path, body) {
  const bodyHash = toHex(await crypto.subtle.digest("SHA-256", encoder.encode(body)));
  const canonical = [ts, nonce, method.toUpperCase(), path, bodyHash].join("\n");
  const key = await crypto.subtle.importKey(
    "raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"],
  );
  return toHex(await crypto.subtle.sign("HMAC", key, encoder.encode(canonical)));
}

export function createClient({ baseUrl, keyId, secret }) {
  return {
    async call(method, path, payload) {
      const body = payload === undefined ? "" : JSON.stringify(payload);
      const ts = Math.floor(Date.now() / 1000);
      const nonce = toHex(crypto.getRandomValues(new Uint8Array(16)));
      const headers = {
        "X-Api-Key": keyId,
        "X-Timestamp": String(ts),
        "X-Nonce": nonce,
        "X-Signature": await sign(secret, ts, nonce, method, path, body),
      };
      if (body) headers["Content-Type"] = "application/json";

      const res = await fetch(baseUrl + path, { method, headers, body: body || undefined });
      const data = await res.json().catch(() => ({}));
      if (!res.ok) throw new Time2payError(res.status, data.error);
      return data;
    },
  };
}

import hashlib
import hmac
import json
import secrets
import time

import requests


class Time2payError(Exception):
    def __init__(self, status, error):
        super().__init__(f"{status} {error.get('code')}: {error.get('message')}")
        self.status = status
        self.code = error.get("code")
        self.details = error.get("details") or {}


def sign(secret, ts, nonce, method, path, body):
    body_hash = hashlib.sha256(body).hexdigest()
    canonical = "\n".join([str(ts), nonce, method.upper(), path, body_hash])
    return hmac.new(secret.encode(), canonical.encode(), hashlib.sha256).hexdigest()


class Time2payClient:
    def __init__(self, base_url, key_id, secret, timeout=30):
        self.base_url = base_url
        self.key_id = key_id
        self.secret = secret
        self.timeout = timeout

    def call(self, method, path, payload=None):
        body = b"" if payload is None else json.dumps(payload, separators=(",", ":")).encode()
        ts = int(time.time())
        nonce = secrets.token_hex(16)
        headers = {
            "X-Api-Key": self.key_id,
            "X-Timestamp": str(ts),
            "X-Nonce": nonce,
            "X-Signature": sign(self.secret, ts, nonce, method, path, body),
        }
        if body:
            headers["Content-Type"] = "application/json"
        resp = requests.request(method, self.base_url + path, data=body or None,
                                headers=headers, timeout=self.timeout)
        data = resp.json() if resp.content else {}
        if resp.status_code >= 300:
            raise Time2payError(resp.status_code, data.get("error", {}))
        return data

import crypto from "node:crypto";

export class Time2payError extends Error {
  constructor(status, error = {}) {
    super(`${status} ${error.code ?? "http_error"}: ${error.message ?? ""}`);
    this.status = status;
    this.code = error.code;
    this.details = error.details ?? {};
  }
}

export function sign(secret, ts, nonce, method, path, body) {
  const bodyHash = crypto.createHash("sha256").update(body).digest("hex");
  const canonical = [ts, nonce, method.toUpperCase(), path, bodyHash].join("\n");
  return crypto.createHmac("sha256", secret).update(canonical).digest("hex");
}

export class Time2payClient {
  constructor({ baseUrl, keyId, secret }) {
    this.baseUrl = baseUrl;
    this.keyId = keyId;
    this.secret = secret;
  }

  async call(method, path, payload) {
    const body = payload === undefined ? "" : JSON.stringify(payload);
    const ts = Math.floor(Date.now() / 1000);
    const nonce = crypto.randomBytes(16).toString("hex");
    const headers = {
      "X-Api-Key": this.keyId,
      "X-Timestamp": String(ts),
      "X-Nonce": nonce,
      "X-Signature": sign(this.secret, ts, nonce, method, path, body),
    };
    if (body) headers["Content-Type"] = "application/json";

    const res = await fetch(this.baseUrl + path, {
      method,
      headers,
      body: body || undefined,
      signal: AbortSignal.timeout(30_000),
    });
    const data = await res.json().catch(() => ({}));
    if (!res.ok) throw new Time2payError(res.status, data.error);
    return data;
  }
}

$client = new Time2payClient(getenv('BASE_URL'), getenv('API_KEY_ID'), getenv('API_KEY_SECRET'));

const client = createClient({ baseUrl: env.BASE_URL, keyId: env.API_KEY_ID, secret: env.API_KEY_SECRET });

client = Time2payClient(os.environ["BASE_URL"], os.environ["API_KEY_ID"], os.environ["API_KEY_SECRET"])

const client = new Time2payClient({
  baseUrl: process.env.BASE_URL,
  keyId: process.env.API_KEY_ID,
  secret: process.env.API_KEY_SECRET,
});