簽章驗證

所有的 API 要求都必須採用 Rapid 的簽章驗證方式。

API 金鑰驗證與存取

您需要使用 HTTP 授權標頭，才能在每個申請中傳輸 API 金鑰與 SHA-512 簽章雜湊。簽章雜湊由 API 金鑰、共用密碼與 UNIX 時間戳記組成。

沒有 API 金鑰？設定帳戶的資訊和說明可在快速入門頁面上找到。

建立授權標題

Rapid 要求授權標頭使用以下格式，請注意，必須加上 EAN 前綴。此前綴可確保正確的授權規則套用至您的要求。

Authorization: EAN APIKey=yourAPIKey,Signature=sha512Hash,timestamp=yourUNIXTimestamp

您的 signature 值，為 API 金鑰 + 共用密碼 + UNIX 時間戳記 (單位為秒) 的 Unsalted SHA-512 雜湊。

您的 timestamp 值必須與用於生成 signature 的值相****同。若提供不同的時間戳記值，Rapid 將無法確認您的簽章雜湊值，且會拒絕您的要求。

以下是完整授權標題的範例：

Authorization: EAN APIKey=dkc4wrkp7w58wx5v2jxen2kx,Signature=Mgup2Azf,timestamp=1476739212

驗證授權標題

嘗試測試要求之前，請先針對 Rapid 簽章產生器測試您的專屬程式碼。

請注意：NTP 時間同步

Rapid 會利用網路時間通訊協定 (NTP) 同步內部伺服器的時間。若您也使用 NTP，就不會發生時間同步方面的問題。大多數的現代作業系統都支援這項或類似的時間同步服務，請查看您的 OS 文件。系統接受時間戳記有合理的時差，容許任一端的伺服器時間戳記最多相差五分鐘。

簽章產生程式碼範例

PHP

$apiKey = "abcdefg";
$secret = "1a2bc3";
$timestamp = time();
$authHeader = 'Authorization: EAN APIKey=' . $apiKey . ',Signature=' . hash("sha512", $apiKey.$secret.$timestamp) . ',timestamp=' . time();

JavaScript

var crypto = require('crypto');
var request = require('request');
var apiKey = '123';
var secret = '123';
var timestamp = Math.round(new Date().getTime() / 1000);
var hash = crypto.createHash('sha512').update(apiKey + secret + timestamp).digest('hex');
var authHeaderValue = 'EAN APIKey=' + apiKey + ',Signature=' + hash + ',timestamp=' + timestamp;

Java

import java.io.UnsupportedEncodingException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.Timestamp;
import java.util.Date;
String apiKey = "123";
String secret = "123";
Date date= new java.util.Date();
Long timestamp = (date.getTime() / 1000);
String signature = null;
try {
   String toBeHashed = apiKey + secret + timestamp;
   MessageDigest md = MessageDigest.getInstance("SHA-512");
   byte[] bytes = md.digest(toBeHashed.getBytes("UTF-8"));
   StringBuilder sb = new StringBuilder();
   for(int i=0; i< bytes.length ;i++){
       sb.append(Integer.toString((bytes[i] & 0xff) + 0x100, 16).substring(1));
   }
   signature = sb.toString();
} catch (NoSuchAlgorithmException e) {
   e.printStackTrace();
} catch (UnsupportedEncodingException e) {
   e.printStackTrace();
}
String authHeaderValue = "EAN APIKey=" + apiKey +  ",Signature=" + signature + ",timestamp=" + timestamp;

Python

#!/usr/bin/env python
import hashlib
import time
apiKey = "123"
secret = "123"
timestamp = str(int(time.time()));
authHeaderValue = "EAN APIKey=" + apiKey + ",Signature=" + hashlib.sha512(apiKey+secret+timestamp).hexdigest() + ",timestamp=" + timestamp

Ruby

require 'digest'
apiKey="123"
secret="123"
timestamp = Time.now.to_i
toBeHashed = "#{apiKey}#{secret}#{timestamp}"
signature = Digest::SHA2.new(512).hexdigest(toBeHashed)
authHeaderValue = "EAN APIKey=#{apiKey},Signature=#{signature},timestamp=#{timestamp}"

C#

String apiKey = "123";
String secret = "123";
TimeSpan epochTicks = new TimeSpan(new DateTime(1970, 1, 1).Ticks);
TimeSpan unixTicks = new TimeSpan(DateTime.UtcNow.Ticks) - epochTicks;
double unixTime = (int)unixTicks.TotalSeconds;
var toBeHashed = apiKey + secret + unixTime;
var bytes = System.Text.Encoding.UTF8.GetBytes(toBeHashed);
using (var hash = System.Security.Cryptography.SHA512.Create())
{
   var hashedInputBytes = hash.ComputeHash(bytes);
   var hashedInputStringBuilder = new System.Text.StringBuilder(128);
   foreach (var b in hashedInputBytes)
       hashedInputStringBuilder.Append(b.ToString("X2"));
   var signature = hashedInputStringBuilder.ToString();
   var authHeaderValue = "EAN APIKey=" + apiKey + ",Signature=" + signature +",timestamp=" + unixTime;
}

Perl

use strict;
use Crypt::Digest::SHA512 qw(sha512_hex);
my $apiKey = '123';
my $secret = '123';
my $timestamp = time;
my $sig = sha512_hex($apiKey . $secret . $timestamp);
my $authHeaderValue = "EAN APIKey=".$apiKey.",Signature=".$sig.",timestamp=".$timestamp;
print $authHeaderValue;

GoLang

apiKey := "123"
secret := "123"
timestamp := strconv.FormatInt(time.Now().Unix(), 10)
c := sha512.New()
c.Write([]byte(apiKey + secret + timestamp))
signature := hex.EncodeToString(c.Sum(nil))
authHeaderValue := "EAN APIKey=" + apiKey + ",Signature=" + signature + ",timestamp=" + timestamp

保護您的共用密碼

請謹慎保管此密碼，因為提供給您的共用密碼，對於防護要求資料的安全非常重要。切勿在任何可公開存取的網站或應用程式程式碼中，加入原始值。若您已獲准整合 Rapid，便會向您提供共用密碼與 API 金鑰。