Authentication

import { createHash, createHmac, randomBytes } from "node:crypto";

// `path` MUST include the query string; `body` is the exact string you send ("" if none).
function signedHeaders(method: string, path: string, body: string, signingSecret: string) {
  const ts = String(Date.now());
  const nonce = randomBytes(16).toString("hex");
  const bodyHash = createHash("sha256").update(body).digest("hex");
  const canonical = [method.toUpperCase(), path, ts, nonce, bodyHash].join("\n");
  const signature = createHmac("sha512", signingSecret).update(canonical).digest("hex");
  return { "X-AbsolutePay-Timestamp": ts, "X-AbsolutePay-Nonce": nonce, "X-AbsolutePay-Signature": signature };
}

import hashlib, hmac, time, uuid

# `path` MUST include the query string; `body` is the exact string you send ("" if none).
def signed_headers(method, path, body, signing_secret):
    ts = str(int(time.time() * 1000))
    nonce = uuid.uuid4().hex
    body_hash = hashlib.sha256(body.encode()).hexdigest()
    canonical = "\n".join([method.upper(), path, ts, nonce, body_hash])
    signature = hmac.new(signing_secret.encode(), canonical.encode(), hashlib.sha512).hexdigest()
    return {
        "X-AbsolutePay-Timestamp": ts,
        "X-AbsolutePay-Nonce": nonce,
        "X-AbsolutePay-Signature": signature,
    }

import (
	"crypto/hmac"
	"crypto/rand"
	"crypto/sha256"
	"crypto/sha512"
	"encoding/hex"
	"strconv"
	"strings"
	"time"
)

// path MUST include the query string; body is the exact string you send ("" if none).
func signedHeaders(method, path, body, signingSecret string) map[string]string {
	ts := strconv.FormatInt(time.Now().UnixMilli(), 10)
	nb := make([]byte, 16)
	rand.Read(nb)
	nonce := hex.EncodeToString(nb)
	bodyHash := sha256.Sum256([]byte(body))
	canonical := strings.Join([]string{strings.ToUpper(method), path, ts, nonce, hex.EncodeToString(bodyHash[:])}, "\n")
	mac := hmac.New(sha512.New, []byte(signingSecret))
	mac.Write([]byte(canonical))
	return map[string]string{
		"X-AbsolutePay-Timestamp": ts,
		"X-AbsolutePay-Nonce":     nonce,
		"X-AbsolutePay-Signature": hex.EncodeToString(mac.Sum(nil)),
	}
}

# Emits the three signing headers as curl -H flags (bash/zsh + openssl).
# This is the sign() helper every curl sample in these docs assumes.
#   usage: curl … -H "Authorization: Bearer $APP_TOKEN" $(sign GET /v1/balances "")
sign() { # sign METHOD PATH BODY — PATH includes the query string; BODY is "" if none
  local ts=$(( $(date +%s) * 1000 ))
  local nonce=$(openssl rand -hex 16)
  local body_hash=$(printf '%s' "$3" | openssl dgst -sha256 | awk '{print $NF}')
  local canonical="$(printf '%s\n%s\n%s\n%s\n%s' "$1" "$2" "$ts" "$nonce" "$body_hash")"
  local sig=$(printf '%s' "$canonical" | openssl dgst -sha512 -hmac "$SIGNING_SECRET" | awk '{print $NF}')
  printf -- '-H X-AbsolutePay-Timestamp:%s -H X-AbsolutePay-Nonce:%s -H X-AbsolutePay-Signature:%s' \
    "$ts" "$nonce" "$sig"
}