In production environments, we recommend using signed requests for authenticating API calls rather than basic authentication. A signed request is hashed and encoded and includes a timestamp so it is more secure.
The following pseudocode example and table demonstrates and explains how to sign a request for the Sinch platform. The result of this should be included in the HTTP authorization
header sent with the HTTP request.
content-MD5 = Base64 ( MD5 ( UTF8 ( [BODY] ) ) )
Scheme = "application"
Signature = Base64 ( HMAC-SHA256 ( Base64-Decode ( ApplicationSecret ), UTF8 ( StringToSign ) ) );
StringToSign = HTTP-Verb + "\n" +
content-MD5 + "\n" +
content-type + "\n" +
CanonicalizedHeaders + "\n" +
CanonicalizedResource;
authorization = Scheme + " " + ApplicationKey + ":" + Signature
Pseudocode Component | Description |
---|---|
CanonicalizedHeaders | The only required header is x-timestamp . |
CanonicalizedResource | The path to the API resource. For example, calling/v1/callouts . |
ApplicationKey | The key for your Voice application found on your dashboard. |
ApplicationSecret | The secret for your Voice application found on your dashboard. Important!: The Application Secret value must be base64-decoded from before it's used for signing. |
HTTP headers are case-insensitive, so you don't need to worry about casing.
For the following POST request to the protected resource /calling/v1/callouts,
POST /calling/v1/callouts
x-timestamp: 2014-06-04T13:41:58Z
content-type: application/json
{"message":"Hello world"}
the signature should be formed like this:
content-MD5 = Base64 ( MD5 ( UTF8 ( [BODY] ) ) )
jANzQ+rgAHyf1MWQFSwvYw==
StringToSign
POST
jANzQ+rgAHyf1MWQFSwvYw==
application/json
x-timestamp:2014-06-04T13:41:58Z
/calling/v1/callouts
Signature = Base64 ( HMAC-SHA256 ( Base64-Decode ( ApplicationSecret:"JViE5vDor0Sw3WllZka15Q==" ), UTF8 ( StringToSign ) ) )
qDXMwzfaxCRS849c/2R0hg0nphgdHciTo7OdM6MsdnM=
HTTP authorization Header authorization: application
5F5C418A0F914BBC8234A9BF5EDDAD97:qDXMwzfaxCRS849c/2R0hg0nphgdHciTo7OdM6MsdnM=
For requests that don't contain a body (like GET requests) or requests where the body is empty, the Content-MD5 value of StringToSign should be left empty, as in the following example:
StringToSign = HTTP-Verb + "\n" +
"\n" +
content-type + "\n" +
CanonicalizedHeaders + "\n" +
CanonicalizedResource;
The client must send a custom header x-timestamp (time) with each request that's validated by the server. This custom header is used to determine that the request is not too old. The timestamp is also part of the signature. The timestamp must be formatted to ISO 8061 specifications.
The timestamp must be in the Coordinated Universal Time (UTC) timezone.
Example
x-timestamp: 2014-06-02T15:39:31.2729234Z
Most of these examples require some setup steps before you can use them. Follow the steps in each language's getting started guide along with these code samples to see how to use a signed request for authentication.
const createHmac = require('create-hmac');
const crypto = require('crypto');
const hash = crypto.createHash('md5');
const utf8 = require('utf8');
const https = require('https');
const util = require('util');
///////////////////////////////////////////////////////////////////////////////////////////
// Add key,secret,cli and endpoint from your chosen application details from dashboard.sinch.com
//////////////////////////////////////////////////////////////////////////////////////////
const application = {
key: '', //key: The application key from the application you wish to use
secret: '', //secret: The secret of the application you wish to use
cli: '', //cli: A number you have purchased from us, or your registered number for test purposes
endpoint: '' //endpoint: The destination E164 formatted number that will receive the callout
};
const bodyData = JSON.stringify({
method: 'ttsCallout',
ttsCallout: {
cli: application.cli,
destination: {
type: 'number',
endpoint: application.endpoint
},
locale: 'en-US',
prompts: '#ssml[<speak><prosody rate="medium">This is a callout application signing test</prosody></speak>];'
}
});
let hmac = crypto.createHmac('sha256', Buffer.from(application.secret, 'base64'));
let contentMD5=hash.update(utf8.encode(bodyData)).digest('base64');
let contentLength = Buffer.byteLength(bodyData);
let timeStampISO = new Date().toISOString()
let stringToSign = 'POST' + '\n' +
contentMD5 + '\n' +
'application/json; charset=UTF-8' + '\n' +
'x-timestamp:'+ timeStampISO + '\n' +
'/calling/v1/callouts';
hmac.update(stringToSign);
let signature = hmac.digest('base64');
const options = {
method: 'POST',
hostname: 'calling.api.sinch.com',
port: 443,
path: '/calling/v1/callouts',
headers: {
'content-Type': 'application/json; charset=UTF-8',
'x-timestamp': timeStampISO ,
'content-length': contentLength,
'authorization': String('application '+ application.key +':' + signature)
},
data: bodyData
}
console.log(util.inspect(options, false, null, true))
const req = https.request(options, (res) => {
res.setEncoding('utf8');
res.on('data', (chunk) => {
console.log(`:: body response: => ${chunk}`);
});
res.on('end', () => {
console.log(':: end of data in body response.');
});
});
req.on('error', (e) => {
console.error(`problem with request: ${e.message}`);
});
req.write(bodyData);
req.end();