Webservice API Hash/Auth Signature Details

Had quite a time figuring out the hash signature part of the API. Important detail: you must Base64 encode the result of the HMACSHA1 hashing of your signature string. That base64 string is what you send on the auth packet that goes to the webservice. Also, your private key that you use for the HMAC hash is NOT in hex - you simply get the text encoding bytes from the string and send it straight to the HMAC method.

Code Example in C#:

// ex: 2008-09-26T14:52:02Z
DateTime now = DateTime.Now;
string timeStamp = now.ToUniversalTime().ToString("yyyy-MM-dd") + "T" + now.ToUniversalTime().ToString("HH:mm:ss") + "Z";

// serviceName + operationName + timestamp
// ex: 2009-04-01/CustomerAPIServicedoesUserExist2008-09-26T14:52:02Z
string preEncodedAuthRequest = "2009-04-01/CustomerAPIServicegetAvailableOfferings" + timeStamp;

 

MACSHA1 crypto = new HMACSHA1(System.Text.Encoding.Default.GetBytes("apiSecretKey"));
byte[] encodedBytes = crypto.ComputeHash(System.Text.Encoding.Default.GetBytes(preEncodedAuthRequest));

string hashedRequest = System.Convert.ToBase64String(encodedBytes);

DigitalChalk.Services.apiAuthenticationPacket authPacket = new DigitalChalk.Services.apiAuthenticationPacket();
authPacket.accessKey = apiPublicKey;
authPacket.signature = hashedRequest;
authPacket.timestamp = timeStamp;

DigitalChalk.Services.CustomerAPIServiceClient svc = new DigitalChalk.Services.CustomerAPIServiceClient();

DigitalChalk.Services.offeringListResult[] result = svc.getAvailableOfferings(authPacket);

Hope that helps any fellow devs out there. Code example is in C# on ASP.NET 3.5