Ebay Signature

[MartinKleiner]

Hi,

Thanks for the Work you're putting into this project. Maybe it would be nice, to add signature to the repository. Made it for my personal use, but didn't (yet) integrate payload signature. Sorry for my bad english, i'm native german speaker.

My actual solution is:
New Controller for the signature

 namespace EbaySharp.Controllers
{
    public class SignatureController
    {
        private string accessToken;

        public SignatureController(string accessToken)
        {
            this.accessToken = accessToken;
        }
        public async Task<SigningKey> GetSigningKey(string keyCipher)
        {
            string requestUrl = $"{Constants.APIZ_SERVER_URL}{Constants.DEVELOPER.ENDPOINT_URL}{Constants.DEVELOPER.KEYMANAGEMENT.ENDPOINT_URL}{string.Format(Constants.DEVELOPER.KEYMANAGEMENT.METHODS.CREATE_SIGNING_KEY)}";
            var Payload = new
            {
                signingKeyCipher = keyCipher
            };

            var jsonPayload = JsonSerializer.Serialize(Payload);
            return await new RequestExecuter().ExecutePostRequest<SigningKey>(requestUrl, $"Bearer {accessToken}", jsonPayload);
        }
    }
}

Model for the signing key:

using System.Text.Json.Serialization;

namespace EbaySharp.Models.Developer.SigningKey
{
    public class SigningKey
    {
        [JsonPropertyName("signingKeyId")]
        public string SigningKeyId { get; set; }
        [JsonPropertyName("signingKeyCipher")]
        public string SigningKeyCipher { get; set; }

        [JsonPropertyName("publicKey")]
        public string PublicKey { get; set; }
        [JsonPropertyName("privateKey")]
        public string PrivateKey { get; set; }

        [JsonPropertyName("jwe")]
        public string Jwe { get; set; }
        [JsonPropertyName("creationTime")]
        public int CreationTime { get; set; }
        [JsonPropertyName("expirationTime")]
        public int ExpirationTime { get; set; }
    }
}

Change in Constants.cs:

        internal struct DEVELOPER
        {
            internal const string ENDPOINT_URL = "/developer";
            internal struct KEYMANAGEMENT
            {
                internal const string ENDPOINT_URL = "/key_management/v1";
                internal struct METHODS
                {
                    internal const string CREATE_SIGNING_KEY = "/signing_key";
                    internal const string GET_SIGNING_KEY = "/signing_key/{0}";
                }
            }
            internal struct ANALYTICS
            {
                internal const string ENDPOINT_URL = "/analytics/v1_beta";
                internal struct METHODS
                {
                    internal const string GET_RATE_LIMITS = "/rate_limit";
                    internal const string GET_USER_RATE_LIMITS = "/user_rate_limit";
                }
            }
            
        }

Change in EbayController:

        #region FINANCES
        public async Task<Transactions> GetTransactions(SigningKey signingKey, string filter = null, string sort = null, int limit = 20, int offset = 0)
        {
            return await new FinancesController(accessToken).GetTransactions(signingKey, filter, sort, limit, offset );
        }
        #endregion

Change in FinancesController:

        #region TRANSACTIONS

        public async Task<Transactions> GetTransactions(SigningKey signingKey, string filter, string sort, int limit = 0, int offset = 0)
        {
            string requestUrl = $"{Constants.APIZ_SERVER_URL}{Constants.SELL.ENDPOINT_URL}{Constants.SELL.FINANCES.ENDPOINT_URL}{string.Format(Constants.SELL.FINANCES.METHODS.GET_TRANSACTIONS, limit, offset)}";
            requestUrl = string.IsNullOrEmpty(filter) ? requestUrl : requestUrl + "&filter=" + filter;
            requestUrl = string.IsNullOrEmpty(sort) ? requestUrl : requestUrl + "&sort=" + sort;
            return await new RequestExecuter().ExecuteGetRequest<Transactions>(requestUrl, $"Bearer {accessToken}", signingKey);
        }


        #endregion

Source to generate signature:
--> I was lazy and took the code from here: https://stackoverflow.com/questions/76034590/ebay-digital-signature-for-restful-apis-sign-signature-base-with-given-private because i had problems with the Keys.

using EbaySharp.Models.Developer.SigningKey;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.OpenSsl;
using Org.BouncyCastle.Security;
using System.Text;

namespace EbaySharp.Source
{
    public static class SignatureGenerator
    {
        public static void GenerateEbaySignatureHeader(HttpRequestMessage request, HttpMethod httpMethod, string requestUrl, SigningKey signingKey)
        {
            // Extract method, path, and authority from the request URL and HTTP method
            string method = httpMethod.Method.ToUpper();
            Uri uri = new(requestUrl);
            string path = uri.AbsolutePath;
            string authority = uri.Host;

            // Generate the current Unix timestamp
            long unixTimeNow = DateTimeOffset.UtcNow.ToUnixTimeSeconds();

            // Create the signature input string
            string signatureParams = $"(\"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\");created={unixTimeNow}";

            // Create the signature base string
            string signatureBase =
                $"\"x-ebay-signature-key\": {signingKey.Jwe}\n" +
                $"\"@method\": {method}\n" +
                $"\"@path\": {path}\n" +
                $"\"@authority\": {authority}\n" +
                $"\"@signature-params\": {signatureParams}";

            byte[] signatureBaseBytes = Encoding.UTF8.GetBytes(signatureBase);

            // Convert private key from base64 and load the private key
            string privKeyString = $"-----BEGIN PRIVATE KEY-----\n{signingKey.PrivateKey}\n-----END PRIVATE KEY-----";
            PemReader pemReader = new(new StringReader(privKeyString));
            AsymmetricKeyParameter pemPrivKey = (AsymmetricKeyParameter)pemReader.ReadObject();

            // Sign the signature base string
            ISigner signer = SignerUtilities.GetSigner("Ed25519");
            signer.Init(true, pemPrivKey);
            signer.BlockUpdate(signatureBaseBytes, 0, signatureBaseBytes.Length);
            byte[] signedSignatureBytes = signer.GenerateSignature();
            string signatureBase64 = Convert.ToBase64String(signedSignatureBytes);

            // Verify 
            string pubKeyString = $"-----BEGIN PUBLIC KEY-----\n{signingKey.PublicKey}\n-----END PUBLIC KEY-----";
            PemReader pemPubReader = new(new StringReader(pubKeyString));
            AsymmetricKeyParameter pemPubKey = (AsymmetricKeyParameter)pemPubReader.ReadObject();
            ISigner verifier = SignerUtilities.GetSigner("Ed25519");
            verifier.Init(false, pemPubKey);
            verifier.BlockUpdate(signatureBaseBytes, 0, signatureBaseBytes.Length);
            bool verified = verifier.VerifySignature(signedSignatureBytes);
            if (!verified) throw new InvalidOperationException("Signature verification failed");

            // Add Signature and Signature-Input headers to the request
            request.Headers.Add("Signature", $"sig1=:{signatureBase64}:");
            request.Headers.Add("Signature-Input", $"sig1={signatureParams}");
            request.Headers.Add("x-ebay-signature-key", signingKey.Jwe);
            request.Headers.Add("x-ebay-enforce-signature", "true");
        }
    }
}

Change in Request Executer:

  internal class RequestExecuter
  {
      private async Task<HttpResponseMessage> executeRequest(HttpMethod httpMethod, string requestUrl, string authHeaderValue, string? contentLanguageHeaderValue, List<KeyValuePair<string, string>>? keyValuePayload
          , string? JSONPayload, SigningKey? signingKey)
      {
          var client = new HttpClient();
          var request = new HttpRequestMessage(httpMethod, requestUrl);
          request.Headers.Add("Authorization", authHeaderValue);

          if (signingKey!=null)
          {
              SignatureGenerator.GenerateEbaySignatureHeader(request, httpMethod, requestUrl, signingKey);
          }

          if (keyValuePayload!=null)
          {
              var content = new FormUrlEncodedContent(keyValuePayload);
              request.Content = content;
          }
          else if (JSONPayload != null)
          {
              var content = new StringContent(JSONPayload, null, "application/json");
              if (string.IsNullOrEmpty(contentLanguageHeaderValue) == false)
              {
                  content.Headers.Add("Content-Language", contentLanguageHeaderValue.Replace("_", "-"));
              }
              request.Content = content;
          }
         
          var response = await client.SendAsync(request);
          return response;
      }
      public async Task<T> ExecuteGetRequest<T>(string requestUrl, string authHeaderValue, SigningKey signingKey = null)
      {
          HttpResponseMessage response = await executeRequest(HttpMethod.Get, requestUrl, authHeaderValue, null, null, null, signingKey);
          string responseContent = await response.Content.ReadAsStringAsync();
          if (response.IsSuccessStatusCode)
          {
              if (string.IsNullOrEmpty(responseContent))
              {
                  throw new Exception("No content found.");
              }
              return responseContent.DeserializeToObject<T>();
          }
          throw new Exception(responseContent);
      }

[shafaqat-ali-cms365]

Thank you for letting me know, may I know If you get any error currently without using signature?
I am trying to understand the reason of having signature with the request so I can implement it.

[MartinKleiner]

Hi,
Source: https://developer.ebay.com/api-docs/sell/finances/resources/transaction/methods/getTransactions

Important! Due to EU & UK Payments regulatory requirements, an additional security verification via Digital Signatures is required for certain API calls that are made on behalf of EU/UK sellers, including all Finances API methods. Please refer to Digital Signatures for APIs to learn more on the impacted APIs and the process to create signatures to be included in the HTTP payload.

Endpoint call fails without signature.

APIs in scope
Signatures are required when the call is made for EU- or UK-domiciled sellers, and only for the following APIs/methods:

All methods in the Finances API
issueRefund in the Fulfillment API
GetAccount in the Trading API
The following methods in the Post-Order API:
Issue Inquiry Refund
Issue case refund
Issue return refund
Process Return Request
Create Cancellation Request
Approve Cancellation Request
Please note that signatures may be added for other APIs and/or for other sellers. eBay's system will ignore the signatures, but the API call will be accepted and handled in an ordinary manner.

I only need getTransactions, that's why i was lazy with the implementation.

[shafaqat-ali-cms365]

Ok, thank you. I will look into it now.

[shafaqat-ali-cms365]

I have pushed a new version and included signing key support. Thank you for your contribution. Please have a test.

[MartinKleiner]

Thanks for implementing it. Works for me (getTransactions) endpoint. I hope my input helped a little bit.

Href: https://apiz.ebay.com/sell/finances/v1/transaction?limit=20&offset=0
Limit: 20
Next: https://apiz.ebay.com/sell/finances/v1/transaction?limit=20&offset=20
Offset: 0
Prev:
Total: 122
TransactionsList: