1

API 文档在这里

唯一的代码示例是在 Java 中，here

每次我尝试进行身份验证时，我都会得到：

{
    "error": "Authorization field missing, malformed or invalid"
}

我已经多次阅读 auth 文档，但仍然没有运气。

这是我的代码：

import requests
import secrets
import codecs

from wsgiref.handlers import format_date_time
from datetime import datetime
from time import mktime

import hashlib
import hmac
import base64

import urllib.parse

key     = '<API_KEY>'
secret  = '<API_SECRET>'

# Getting current time
now = datetime.now()
stamp = mktime(now.timetuple())

# Formats time into this format --> Mon, 25 Jul 2016 16:36:07 GMT
formated_time = format_date_time(stamp)

# Generates a secure random string for the nonce
nonce = secrets.token_urlsafe(30)

# Combines date and nonce into a single string that will be signed
signature_string = 'date' + ':' + formated_time + '\n' + 'x-mod-nonce' + ':' + nonce

# Expected output example --> date: Mon, 25 Jul 2016 16:36:07 GMT\nx-mod-nonce: 28154b2-9c62b93cc22a-24c9e2-5536d7d

# Encodes secret and message into a format that can be signed
secret = bytes(secret, encoding='utf-8')
message = bytes(signature_string,encoding='utf-8')

# Signing process
digester = hmac.new(secret, message, hashlib.sha1)

# Converts to hex
hex_code = digester.hexdigest()

# Decodes the signed string in hex into base64
b64 = codecs.encode(codecs.decode(hex_code, 'hex'), 'base64').decode()

# Encodes the string so it is safe for URL
url_safe_code = urllib.parse.quote(b64,safe='')

# Adds the key and signed response
authorization = f'Signature keyId="{key}",algorithm="hmac-sha1",headers="date x-mod-nonce",signature="{url_safe_code}"'

account_id = 'A120BU48'

url = f'https://api-sandbox.modulrfinance.com/api-sandbox/accounts/{account_id}'

headers = {
    'Authorization': authorization, # Authorisation header
    'Date' : formated_time,         # Date header
    'x-mod-nonce': nonce,           # Addes nonce
    'accept': 'application/json',
    }

response = requests.get(url,headers=headers)

print(response.text)

我不确定这个过程哪里出了问题，据我所知，当我从身份验证示例中添加测试数据时，签名被正确签名，我得到了预期的字符串。

如果您想尝试使用真正的 API 密钥，请在此处注册访问

我试图调用的 API 端点的文档在这里

4

1 回答 1

2

您链接的文档在冒号和值之间有一个空格。

signature_string = 'date' + ':' + formated_time + '\n' + 'x-mod-nonce' + ':' + nonce

应该：
signature_string = 'date' + ': ' + formated_time + '\n' + 'x-mod-nonce' + ': ' + nonce

或（更简单）：
signature_string = 'date: ' + formated_time + '\n' + 'x-mod-nonce: ' + nonce

更新
我注册看看发生了什么。我还在文档中给出的示例上运行了您的代码，发现签名并不完全正确。
除了我上面建议的更改之外，还需要进行进一步的更改。

换线后

b64 = codecs.encode(codecs.decode(hex_code, 'hex'), 'base64').decode()

至

b64 = codecs.encode(codecs.decode(hex_code, 'hex'), 'base64').decode().strip()

示例的签名匹配。

在此之后，我能够使用自己的密钥连接到 API。

这是完整的工作代码：

import codecs
import hashlib
import hmac
import secrets
import urllib.parse
from datetime import datetime
from time import mktime
from wsgiref.handlers import format_date_time

import requests

key = '<key>'
secret = '<secret>'
account_id = '<account id>'
url = f'https://api-sandbox.modulrfinance.com/api-sandbox/accounts/{account_id}'

# Getting current time
now = datetime.now()
stamp = mktime(now.timetuple())

# Formats time into this format --> Mon, 25 Jul 2016 16:36:07 GMT
formatted_time = format_date_time(stamp)

# Generates a secure random string for the nonce
nonce = secrets.token_urlsafe(30)

# Combines date and nonce into a single string that will be signed
signature_string = 'date' + ': ' + formatted_time + '\n' + 'x-mod-nonce' + ': ' + nonce

# Encodes secret and message into a format that can be signed
secret = bytes(secret, encoding='utf-8')
message = bytes(signature_string, encoding='utf-8')

# Signing process
digester = hmac.new(secret, message, hashlib.sha1)

# Converts to hex
hex_code = digester.hexdigest()

# Decodes the signed string in hex into base64
b64 = codecs.encode(codecs.decode(hex_code, 'hex'), 'base64').decode().strip()

# Encodes the string so it is safe for URL
url_safe_code = urllib.parse.quote(b64, safe='')

# Adds the key and signed response
authorization = f'Signature keyId="{key}",algorithm="hmac-sha1",headers="date x-mod-nonce",signature="{url_safe_code}"'

headers = {
    'Authorization': authorization,  # Authorisation header
    'Date': formatted_time,  # Date header
    'x-mod-nonce': nonce,  # Adds nonce
    'accept': 'application/json',
}

response = requests.get(url, headers=headers)

print(response.text)
于 2019-06-28T11:05:13.510 回答