Request Signing

#!/bin/bash

# Configuration
API_KEY="ofx_sk_sandbox_abc123def456"
PRIVATE_KEY_FILE="openfx_ed25519.pem"

# Request details
METHOD="GET"
PATH="/v1/entities?limit=10"
TIMESTAMP=$(date +%s)
BODY=""

# Step 1: Build signing payload
SIGNING_PAYLOAD="${METHOD}\n${PATH}\n${TIMESTAMP}\n${BODY}"

# Step 2-3: Sign and Base64-encode
SIGNATURE=$(printf "${SIGNING_PAYLOAD}" \
  | openssl pkeyutl -sign -inkey "${PRIVATE_KEY_FILE}" \
  | base64)

# Steps 4-6: Send request with all three headers
curl -X GET "https://sandbox.api.openfx.com${PATH}" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "X-Signature: ${SIGNATURE}" \
  -H "X-Timestamp: ${TIMESTAMP}" \
  -H "Content-Type: application/json"

#!/bin/bash

# Configuration
API_KEY="ofx_sk_sandbox_abc123def456"
PRIVATE_KEY_FILE="openfx_ed25519.pem"

# Request details
METHOD="POST"
PATH="/v1/payments"
TIMESTAMP=$(date +%s)
BODY='{"sourceAccountId":"acc_01953e1a5f4b7001","value": "150000","currency":"USD","rail":"ach","counterpartyId":"cpt_01953e1a5f4b7002","paymentMethodId":"pm_01953e1a5f4b7003","description":"Invoice #1042"}'

# Step 1: Build signing payload
SIGNING_PAYLOAD="${METHOD}\n${PATH}\n${TIMESTAMP}\n${BODY}"

# Step 2-3: Sign and Base64-encode
SIGNATURE=$(printf "${SIGNING_PAYLOAD}" \
  | openssl pkeyutl -sign -inkey "${PRIVATE_KEY_FILE}" \
  | base64)

# Steps 4-6: Send request with all three headers
curl -X POST "https://sandbox.api.openfx.com${PATH}" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "X-Signature: ${SIGNATURE}" \
  -H "X-Timestamp: ${TIMESTAMP}" \
  -H "X-Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d "${BODY}"

import time
import json
import base64
from cryptography.hazmat.primitives import serialization


class OpenFXSigner:
    """Reusable request signer for the OpenFX API."""

    def __init__(self, api_key: str, private_key_path: str):
        self.api_key = api_key
        with open(private_key_path, "rb") as f:
            self.private_key = serialization.load_pem_private_key(
                f.read(), password=None
            )

    def sign_request(
        self,
        method: str,
        path: str,
        body: str = "",
    ) -> dict:
        """Build authentication headers for a request.

        Args:
            method: HTTP method (GET, POST, PATCH, DELETE).
            path: Request path with query string (e.g., /v1/entities?limit=10).
            body: Serialized request body, or empty string for no body.

        Returns:
            Dict of headers to merge into the request.
        """
        timestamp = str(int(time.time()))
        signing_payload = f"{method}\n{path}\n{timestamp}\n{body}"
        signature_bytes = self.private_key.sign(
            signing_payload.encode("utf-8")
        )
        signature_b64 = base64.b64encode(signature_bytes).decode("utf-8")

        return {
            "Authorization": f"Bearer {self.api_key}",
            "X-Signature": signature_b64,
            "X-Timestamp": timestamp,
            "Content-Type": "application/json",
        }


# Usage
signer = OpenFXSigner(
    api_key="ofx_sk_sandbox_abc123def456",
    private_key_path="openfx_ed25519.pem",
)

# GET request
headers = signer.sign_request("GET", "/v1/accounts")
response = requests.get("https://sandbox.api.openfx.com/v1/accounts", headers=headers)

# POST request
body = json.dumps({"sellCurrency": "USD", "buyCurrency": "EUR", "sellAmount": "10000.00"}, separators=(",", ":"))
headers = signer.sign_request("POST", "/v1/fx/quotes", body=body)
response = requests.post("https://sandbox.api.openfx.com/v1/fx/quotes", headers=headers, data=body)