Request Signature

Overview

Requests sent to the server have to be digitally signed for purposes of authentication. The signature uses the Date header and signing algorithm used in License API Authorization.

Signature Structure

The signature in the Authorization header is a Base64-encoded HMAC-hashed value of the signing string, which is composed of:

1

Constant string

A constant string: licenseSpring

2

Newline

A newline character \n

3

Date header

The value of the Date header being sent in the request (see License API Authorization for more details). This is a date string in RFC7231 format

This signing string is then hashed with the customer's key (shared key) using the algorithm provided in the Authorization header (e.g. HMAC-SHA256). The resulting hash is then encoded in Base64.

Make sure the encoded string has no extra whitespace on any line, otherwise the base64 encoded value will be incorrect.

Example of Signature Generation

The following is an example of how to generate a signature. First, let's assume the following values:

• Your company's shared key is kw4qSnpSwXzgiv5yxYpZZmFEd9QAeiKTQ6OuyMja

• The Date header you set in the request is Tue, 07 Jun 2011 20:51:35 GMT

• We'll use the default hashing algorithm, HMAC-SHA256

Now we can generate the signature:

Create the signing string:

licenseSpring
date: Tue, 07 Jun 2011 20:51:35 GMT

Hash the signing string using HMAC-SHA256

Encode the hashed value with Base64: UDysfR6MndUZReo07Y9r+vErn8vSxrnQ5ulit18iJ/Q=

The resulting string is then inserted into the Authorization header as the "signature" parameter:

algorithm="hmac-sha256", headers="date", signature="UDysfR6MndUZReo07Y9r+vErn8vSxrnQ5ulit18iJ/Q=", apikey="_company_api_key_here_"

Sample Code

Generating a signature

JavaScript

const crypto = require('node:crypto'),
    shared_key = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
    signing_string = 'licenseSpring\ndate: Tue, 07 Jun 2011 20:51:35 GMT';

let signature = crypto.createHmac('sha256', shared_key).update(signing_string).digest('base64');

console.log(signature);
// UDysfR6MndUZReo07Y9r+vErn8vSxrnQ5ulit18iJ/Q=

Python

Generating full HTTP request headers with SDK Demo keys

JavaScript

const fetch = require('node-fetch');

const sharedKey = 'XXXXXXXXX-XXXXX-XXXXXXXXXXXXX_XXXXXX_XXXXXX',
      apiKey = 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX',
      productCode = "XX",
      baseURL = 'https://api.licensespring.com/api/v4/webhook';

function GenerateHeaders(){
    const signingDate = (new Date()).toUTCString(),
          signingString = `licenseSpring\ndate: ${signingDate}`;

    const signature = crypto.createHmac('sha256', sharedKey).update(signingString).digest('base64');

    return {
            'Content-Type': 'application/json',
            'Date': signingDate,
            'Authorization' : `algorithm="hmac-sha256",headers="date",signature="${signature}",apikey="${apiKey}"`,
        };
}

Python

Full sample code for checking a license key with SDK Demo keys

JavaScript

const fetch = require('node-fetch');

const sharedKey = 'XXXXXXXXX-XXXXX-XXXXXXXXXXXXX_XXXXXX_XXXXXX',
      apiKey = 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX',
      productCode = "XX",
      baseURL = 'https://api.licensespring.com/api/v4';

function GenerateHeaders(){
    const signingDate = (new Date()).toUTCString(),
          signingString = `licenseSpring\ndate: ${signingDate}`;

    const signature = crypto.createHmac('sha256', sharedKey).update(signingString).digest('base64');

    return {
            'Content-Type': 'application/json',
            'Date': signingDate,
            'Authorization' : `algorithm="hmac-sha256",headers="date",signature="${signature}",apikey="${apiKey}"`,
        };
}

const checkLicense = async (hwid, licenseKey) => {
    const headers = GenerateHeaders()

    const response = await fetch(baseURL + '/check_license' + `?product=${productCode}&hardware_id=${hwid}&license_key=${licenseKey}`, {
        method: 'GET',
        headers: headers
    })
    console.log("/license response", await response.json());
}

checkLicense('d32q3ed3rq3rxq2r3q23q23q23', '1111-2222-3333-4444');

Python