Signed Request

import java.io.IOException;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.time.ZoneOffset;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import java.util.Base64;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class App {

    public static void main(String[] args) throws NoSuchAlgorithmException, InvalidKeyException, IOException, InterruptedException {
        var applicationKey = "";
        var applicationSecret = "";
        var b64DecodedApplicationSecret = Base64.getDecoder().decode(applicationSecret);

        var toNumber = "";

        var sinchVerificationUrl = "https://verification.api.sinch.com/verification/v1/verifications";

        var verificationRequest = """
            {
                "identity": {
                  "type": "number",
                  "endpoint": "%s"
                  },
                  "method": "sms"
                }
            }
            """.formatted(toNumber);
        
        byte[] encodedVerificationRequest = verificationRequest.getBytes(StandardCharsets.UTF_8);

        MessageDigest md = MessageDigest.getInstance("MD5");
        md.update(encodedVerificationRequest);
        var encodedMd5ToBase64VerificationRequest = Base64.getEncoder().encode(md.digest());
        
        var httpVerb = "POST";
        var requestContentType = "application/json; charset=UTF-8";
        var timeNow = ZonedDateTime.now(ZoneOffset.UTC).format(DateTimeFormatter.ISO_INSTANT);
        var requestTimeStamp = "x-timestamp:" + timeNow;
        var requestUriPath = "/verification/v1/verifications";

        var stringToSign = String.join(System.lineSeparator()
            , httpVerb
            , new String(encodedMd5ToBase64VerificationRequest, StandardCharsets.UTF_8)
            , requestContentType
            , requestTimeStamp
            , requestUriPath
        );

        SecretKeySpec secretKeySpec = new SecretKeySpec(b64DecodedApplicationSecret, "HmacSHA256");
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(secretKeySpec);
        byte[] hmacSha256 = mac.doFinal(stringToSign.getBytes());

        var authorizationSiganture = new String(Base64.getEncoder().encode(hmacSha256), StandardCharsets.UTF_8);

        var httpClient = HttpClient.newBuilder().build();

        var request = HttpRequest.newBuilder()
            .POST(HttpRequest.BodyPublishers.ofString(verificationRequest))
            .uri(URI.create(sinchVerificationUrl))
            .header("Content-Type", requestContentType)
            .header("Authorization", "Application " + applicationKey + ":" + authorizationSiganture)
            .header("x-timestamp", timeNow)
            .build();

        var response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

import hashlib
import hmac
import base64
from datetime import datetime, timezone
import requests
import json


application_key = ''
application_secret = ''
number_to_authenticate = ''

verification_request = {
    "identity": {
        "type": "number",
        "endpoint": number_to_authenticate
    },
    "method": "sms"
}


b64_encoded_application_secret = base64.b64decode(application_secret)
encoded_verification_request = json.dumps(verification_request).encode()
md5_verification_request = hashlib.md5(encoded_verification_request)
encoded_MD5_to_base64_verification_request = base64.b64encode(md5_verification_request.digest())

http_verb = 'POST'
request_content_type = 'application/json; charset=UTF-8'
time_now = datetime.now(timezone.utc).isoformat()
request_timestamp = "x-timestamp:" + time_now
request_uri_path = '/verification/v1/verifications'

string_to_sign = (
    http_verb + "\n"
    + encoded_MD5_to_base64_verification_request.decode() + "\n"
    + request_content_type + "\n"
    + request_timestamp + "\n"
    + request_uri_path
)

authorization_signature = base64.b64encode(
    hmac.new(b64_encoded_application_secret, string_to_sign.encode(), hashlib.sha256).digest()
).decode()

headers = {
    "Content-Type": request_content_type,
    "Authorization": (f"Application {application_key}:{authorization_signature}"),
    "x-timestamp": time_now
}

auth_response = requests.post(
    "https://verification.api.sinch.com/verification/v1/verifications",
    json=verification_request,
    headers=headers
)

print(auth_response.json())

<?php

declare(strict_types=1);

$applicationKey = "";
$applicationSecret= "";
$b64DecodedApplicationSecret = base64_decode($applicationSecret, true);

$toNumber = "";

$sinchVerificationUrl = "https://verification.api.sinch.com/verification/v1/verifications";

$verificationRequest = [
  "identity" => [
    "type" => "number",
    "endpoint" => $toNumber
    ],
    "method" => "sms"
  ]
];

$encodedVerificationRequest = utf8_encode(json_encode($verificationRequest, JSON_UNESCAPED_UNICODE));
$md5VerificationRequest = md5($encodedVerificationRequest, true);
$encodedMd5ToBase64VerificationRequest = base64_encode($md5VerificationRequest);

$httpVerb = 'POST';
$requestContentType = 'application/json; charset=UTF-8';
date_default_timezone_set('UTC');
$timeNow = date(DateTime::ATOM);
$requestTimeStamp = "x-timestamp:" . $timeNow;
$requestUriPath = "/verification/v1/verifications/";

$stringToSign = $httpVerb . "\n"
    . $encodedMd5ToBase64VerificationRequest . "\n"
    . $requestContentType . "\n"
    . $requestTimeStamp . "\n"
    . $requestUriPath;

$authorizationSignature = base64_encode(hash_hmac("sha256", $stringToSign, $b64DecodedApplicationSecret, true));

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_HTTPHEADER => [
    "Content-Type: {$requestContentType}",
    "x-timestamp: {$timeNow}",
    "Authorization: Application {$applicationKey}:{$authorizationSignature}"
  ],
  CURLOPT_POSTFIELDS => json_encode($verificationRequest),
  CURLOPT_URL => $sinchVerificationUrl,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => $httpVerb,
]);

$response = curl_exec($curl);
$error = curl_error($curl);

curl_close($curl);

echo $response;