API Authentication: JWT RS256 and RSA-4096 Key Setup

const fs = require("fs");
const crypto = require("crypto");
const jwt = require("jsonwebtoken"); // npm install jsonwebtoken

const privateKey = fs.readFileSync("private_key.pem", "utf8");
const apiKey = "4466c45a-7b28-4c50-a0f7-198f8d7f34c5";

function buildAuthHeaders(uri, body = "") {
  const rawBody = body ? JSON.stringify(body) : "";
  const bodyHash = crypto
    .createHash("sha256")
    .update(rawBody)
    .digest("hex");

  const iat = Math.floor(Date.now() / 1000);
  const exp = iat + 29; // strictly less than iat + 30

  const payload = {
    uri,
    nonce: crypto.randomUUID(),
    iat,
    exp,
    sub: apiKey,
    bodyHash,
  };

  const token = jwt.sign(payload, privateKey, { algorithm: "RS256" });

  return {
    Authorization: `Bearer ${token}`,
    "x-api-key": apiKey,
    "Content-Type": "application/json",
  };
}

// Example: POST /dac/v1/transactions
const headers = buildAuthHeaders("/dac/v1/transactions", {
  asset: "BTC",
  amount: 0.0675,
  type: "Withdraw",
  ts: Date.now(),
});

import json
import time
import uuid
import hashlib

import jwt  # pip install PyJWT cryptography

with open("private_key.pem", "rb") as f:
    private_key = f.read()

API_KEY = "4466c45a-7b28-4c50-a0f7-198f8d7f34c5"


def build_auth_headers(uri: str, body: dict | None = None) -> dict:
    raw_body = json.dumps(body, separators=(",", ":")) if body else ""
    body_hash = hashlib.sha256(raw_body.encode()).hexdigest()

    iat = int(time.time())
    exp = iat + 29  # strictly less than iat + 30

    payload = {
        "uri": uri,
        "nonce": str(uuid.uuid4()),
        "iat": iat,
        "exp": exp,
        "sub": API_KEY,
        "bodyHash": body_hash,
    }

    token = jwt.encode(payload, private_key, algorithm="RS256")

    return {
        "Authorization": f"Bearer {token}",
        "x-api-key": API_KEY,
        "Content-Type": "application/json",
    }


# Example: POST /dac/v1/transactions
headers = build_auth_headers(
    "/dac/v1/transactions",
    {"asset": "BTC", "amount": 0.0675, "type": "Withdraw", "ts": int(time.time() * 1000)},
)

using System;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;
// NuGet: Microsoft.IdentityModel.Tokens, System.IdentityModel.Tokens.Jwt

public static class FinrockAuth
{
    private const string ApiKey = "4466c45a-7b28-4c50-a0f7-198f8d7f34c5";

    public static (string Authorization, string XApiKey) BuildAuthHeaders(
        string uri,
        string rawBody = "")
    {
        // Compute bodyHash
        byte[] hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(rawBody));
        string bodyHash = Convert.ToHexString(hashBytes).ToLowerInvariant();

        long iat = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
        long exp = iat + 29; // strictly less than iat + 30

        // Load RSA private key
        using var rsa = RSA.Create();
        rsa.ImportFromPem(File.ReadAllText("private_key.pem"));

        var rsaKey = new RsaSecurityKey(rsa);
        var credentials = new SigningCredentials(rsaKey, SecurityAlgorithms.RsaSha256);

        var claims = new[]
        {
            new System.Security.Claims.Claim("uri", uri),
            new System.Security.Claims.Claim("nonce", Guid.NewGuid().ToString()),
            new System.Security.Claims.Claim("sub", ApiKey),
            new System.Security.Claims.Claim("bodyHash", bodyHash),
        };

        var tokenDescriptor = new SecurityTokenDescriptor
        {
            Subject = new System.Security.Claims.ClaimsIdentity(claims),
            IssuedAt = DateTimeOffset.FromUnixTimeSeconds(iat).UtcDateTime,
            Expires = DateTimeOffset.FromUnixTimeSeconds(exp).UtcDateTime,
            SigningCredentials = credentials,
        };

        var handler = new JwtSecurityTokenHandler();
        var token = handler.CreateEncodedJwt(tokenDescriptor);

        return ($"Bearer {token}", ApiKey);
    }
}

<?php
// composer require firebase/php-jwt
use Firebase\JWT\JWT;

$apiKey    = '4466c45a-7b28-4c50-a0f7-198f8d7f34c5';
$privateKey = file_get_contents('private_key.pem');

function buildAuthHeaders(string $uri, string $rawBody = ''): array
{
    global $apiKey, $privateKey;

    $bodyHash = hash('sha256', $rawBody);

    $iat = time();
    $exp = $iat + 29; // strictly less than iat + 30

    $payload = [
        'uri'      => $uri,
        'nonce'    => bin2hex(random_bytes(16)),
        'iat'      => $iat,
        'exp'      => $exp,
        'sub'      => $apiKey,
        'bodyHash' => $bodyHash,
    ];

    $token = JWT::encode($payload, $privateKey, 'RS256');

    return [
        'Authorization' => "Bearer {$token}",
        'x-api-key'     => $apiKey,
        'Content-Type'  => 'application/json',
    ];
}

// Example: POST /dac/v1/transactions
$body    = json_encode(['asset' => 'BTC', 'amount' => 0.0675,
                        'type' => 'Withdraw', 'ts' => round(microtime(true) * 1000)]);
$headers = buildAuthHeaders('/dac/v1/transactions', $body);
?>