Modulr API 的身份验证失败 - Python

Question

The API docs are here

The only code example is in Java, here

Every time I try to authenticate I get:

{
    "error": "Authorization field missing, malformed or invalid"
}

I have been through the auth docs many times over and still no luck.

Here is my code:

import requests
import secrets
import codecs

from wsgiref.handlers import format_date_time
from datetime import datetime
from time import mktime

import hashlib
import hmac
import base64

import urllib.parse

key     = '<API_KEY>'
secret  = '<API_SECRET>'

# Getting current time
now = datetime.now()
stamp = mktime(now.timetuple())

# Formats time into this format --> Mon, 25 Jul 2016 16:36:07 GMT
formated_time = format_date_time(stamp)

# Generates a secure random string for the nonce
nonce = secrets.token_urlsafe(30)

# Combines date and nonce into a single string that will be signed
signature_string = 'date' + ':' + formated_time + '\n' + 'x-mod-nonce' + ':' + nonce

# Expected output example --> date: Mon, 25 Jul 2016 16:36:07 GMT\nx-mod-nonce: 28154b2-9c62b93cc22a-24c9e2-5536d7d

# Encodes secret and message into a format that can be signed
secret = bytes(secret, encoding='utf-8')
message = bytes(signature_string,encoding='utf-8')

# Signing process
digester = hmac.new(secret, message, hashlib.sha1)

# Converts to hex
hex_code = digester.hexdigest()

# Decodes the signed string in hex into base64
b64 = codecs.encode(codecs.decode(hex_code, 'hex'), 'base64').decode()

# Encodes the string so it is safe for URL
url_safe_code = urllib.parse.quote(b64,safe='')

# Adds the key and signed response
authorization = f'Signature keyId="{key}",algorithm="hmac-sha1",headers="date x-mod-nonce",signature="{url_safe_code}"'

account_id = 'A120BU48'

url = f'https://api-sandbox.modulrfinance.com/api-sandbox/accounts/{account_id}'

headers = {
    'Authorization': authorization, # Authorisation header
    'Date' : formated_time,         # Date header
    'x-mod-nonce': nonce,           # Addes nonce
    'accept': 'application/json',
    }

response = requests.get(url,headers=headers)

print(response.text)

I am not sure where the process is going wrong, as far as I know, the signature is being signed correctly as I added in the test data from the authentication example and I get the expected string.

If you want to try with real API keys, register for access here

The docs for the API endpoint I am trying to call is here

Answer 1

The docs you linked has a space between the colon and the values.

signature_string = 'date' + ':' + formated_time + '\\n' + 'x-mod-nonce' + ':' + nonce

should be:
signature_string = 'date' + ': ' + formated_time + '\\n' + 'x-mod-nonce' + ': ' + nonce

or (simpler):
signature_string = 'date: ' + formated_time + '\\n' + 'x-mod-nonce: ' + nonce

Update
I registered to see what is going on. I also ran your code on the example given in the documentation and saw that the signature is not entirely correct.
In addition to the change I suggested above, a further change was necessary.

After changing the line

b64 = codecs.encode(codecs.decode(hex_code, 'hex'), 'base64').decode()

to

b64 = codecs.encode(codecs.decode(hex_code, 'hex'), 'base64').decode().strip()

the signature of the example matched.

After this I was able to connect to the API with my own keys.

Here is the complete working code:

import codecs
import hashlib
import hmac
import secrets
import urllib.parse
from datetime import datetime
from time import mktime
from wsgiref.handlers import format_date_time

import requests

key = '<key>'
secret = '<secret>'
account_id = '<account id>'
url = f'https://api-sandbox.modulrfinance.com/api-sandbox/accounts/{account_id}'

# Getting current time
now = datetime.now()
stamp = mktime(now.timetuple())

# Formats time into this format --> Mon, 25 Jul 2016 16:36:07 GMT
formatted_time = format_date_time(stamp)

# Generates a secure random string for the nonce
nonce = secrets.token_urlsafe(30)

# Combines date and nonce into a single string that will be signed
signature_string = 'date' + ': ' + formatted_time + '\n' + 'x-mod-nonce' + ': ' + nonce

# Encodes secret and message into a format that can be signed
secret = bytes(secret, encoding='utf-8')
message = bytes(signature_string, encoding='utf-8')

# Signing process
digester = hmac.new(secret, message, hashlib.sha1)

# Converts to hex
hex_code = digester.hexdigest()

# Decodes the signed string in hex into base64
b64 = codecs.encode(codecs.decode(hex_code, 'hex'), 'base64').decode().strip()

# Encodes the string so it is safe for URL
url_safe_code = urllib.parse.quote(b64, safe='')

# Adds the key and signed response
authorization = f'Signature keyId="{key}",algorithm="hmac-sha1",headers="date x-mod-nonce",signature="{url_safe_code}"'

headers = {
    'Authorization': authorization,  # Authorisation header
    'Date': formatted_time,  # Date header
    'x-mod-nonce': nonce,  # Adds nonce
    'accept': 'application/json',
}

response = requests.get(url, headers=headers)

print(response.text)