Finrock API Authentication: JWT Tokens and API Keys

// Full example: https://github.com/gofinrock/jwt-snippets/blob/main/node.js
const fs = require("fs");
const crypto = require("crypto");
const jwt = require("jsonwebtoken"); // npm install jsonwebtoken

const privateKey = fs.readFileSync("private_key.pem", "utf8");
const apiKey = "4466c45a-7b28-4c50-a0f7-198f8d7f34c5";

function buildAuthHeaders(uriPath, requestBody = "") {
  const now = Math.floor(Date.now() / 1000);

  const bodyHash = crypto
    .createHash("sha256")
    .update(requestBody, "utf8")
    .digest("hex");

  const payload = {
    uri: uriPath,
    nonce: crypto.randomUUID(),
    iat: now,
    exp: now + 25, // less than iat + 30
    sub: apiKey,
    bodyHash,
  };

  const token = jwt.sign(payload, privateKey, { algorithm: "RS256" });

  return {
    Authorization: `Bearer ${token}`,
    "x-api-key": apiKey,
    "Content-Type": "application/json",
  };
}

// Usage
const body = JSON.stringify({ asset: "BTC" });
const headers = buildAuthHeaders("/dac/v1/create-wallet", body);
console.log(headers);

# Full example: https://github.com/gofinrock/jwt-snippets/blob/main/python.py
import hashlib
import time
import uuid
import json

import jwt  # pip install PyJWT
from cryptography.hazmat.primitives import serialization

with open("private_key.pem", "rb") as f:
    private_key = serialization.load_pem_private_key(f.read(), password=None)

API_KEY = "4466c45a-7b28-4c50-a0f7-198f8d7f34c5"

def build_auth_headers(uri_path: str, request_body: str = "") -> dict:
    now = int(time.time())

    body_hash = hashlib.sha256(request_body.encode("utf-8")).hexdigest()

    payload = {
        "uri": uri_path,
        "nonce": str(uuid.uuid4()),
        "iat": now,
        "exp": now + 25,  # must be less than iat + 30
        "sub": API_KEY,
        "bodyHash": body_hash,
    }

    token = jwt.encode(payload, private_key, algorithm="RS256")

    return {
        "Authorization": f"Bearer {token}",
        "x-api-key": API_KEY,
        "Content-Type": "application/json",
    }

# Usage
body = json.dumps({"asset": "BTC"})
headers = build_auth_headers("/dac/v1/create-wallet", body)
print(headers)

// Full example: https://github.com/gofinrock/jwt-snippets/blob/main/csharp.cs
using System;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;

// Requires: dotnet add package System.IdentityModel.Tokens.Jwt
//           dotnet add package Microsoft.IdentityModel.Tokens

const string apiKey = "4466c45a-7b28-4c50-a0f7-198f8d7f34c5";
string privateKeyPem = File.ReadAllText("private_key.pem");

(string authHeader, string apiKeyHeader) BuildAuthHeaders(string uriPath, string requestBody = "")
{
    long now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();

    byte[] bodyBytes = Encoding.UTF8.GetBytes(requestBody);
    byte[] hashBytes = SHA256.HashData(bodyBytes);
    string bodyHash = Convert.ToHexString(hashBytes).ToLower();

    using var rsa = RSA.Create();
    rsa.ImportFromPem(privateKeyPem);
    var rsaKey = new RsaSecurityKey(rsa);
    var credentials = new SigningCredentials(rsaKey, SecurityAlgorithms.RsaSha256);

    var claims = new[]
    {
        new Claim("uri", uriPath),
        new Claim("nonce", Guid.NewGuid().ToString()),
        new Claim("iat", now.ToString(), ClaimValueTypes.Integer64),
        new Claim("exp", (now + 25).ToString(), ClaimValueTypes.Integer64),
        new Claim("sub", apiKey),
        new Claim("bodyHash", bodyHash),
    };

    var token = new JwtSecurityToken(claims: claims, signingCredentials: credentials);
    string jwt = new JwtSecurityTokenHandler().WriteToken(token);

    return ($"Bearer {jwt}", apiKey);
}

// Usage
string body = JsonSerializer.Serialize(new { asset = "BTC" });
var (auth, key) = BuildAuthHeaders("/dac/v1/create-wallet", body);
Console.WriteLine($"Authorization: {auth}");
Console.WriteLine($"x-api-key: {key}");

<?php
// Full example: https://github.com/gofinrock/jwt-snippets/blob/main/php-example.php
// Requires: composer require firebase/php-jwt

use Firebase\JWT\JWT;

$privateKey = file_get_contents('private_key.pem');
$apiKey = '4466c45a-7b28-4c50-a0f7-198f8d7f34c5';

function buildAuthHeaders(string $uriPath, string $requestBody = ''): array
{
    global $privateKey, $apiKey;

    $now = time();
    $bodyHash = hash('sha256', $requestBody);

    $payload = [
        'uri'      => $uriPath,
        'nonce'    => bin2hex(random_bytes(16)),
        'iat'      => $now,
        'exp'      => $now + 25, // must be less than iat + 30
        'sub'      => $apiKey,
        'bodyHash' => $bodyHash,
    ];

    $token = JWT::encode($payload, $privateKey, 'RS256');

    return [
        'Authorization' => 'Bearer ' . $token,
        'x-api-key'     => $apiKey,
        'Content-Type'  => 'application/json',
    ];
}

// Usage
$body = json_encode(['asset' => 'BTC']);
$headers = buildAuthHeaders('/dac/v1/create-wallet', $body);
print_r($headers);