Generate Auth Token for Vendor API

This document explains how to generate an HMAC token for vendor API calls. Use this token in the Authorization header when calling protected vendor endpoints.

Repository

GitHub - fhyfirman/generate-hmac-auth-token

Prerequisites

• Node.js project with axios, humps, and crypto-js
• Vendor credentials (API_KEY, API_SECRET_KEY)
• For Postman: environment variables API_KEY and API_SECRET_KEY

Install dependencies:

npm install axios humps crypto-js

Generate using TypeScript

Note: VUE_APP_* env variables are Vue-specific. For other frameworks, replace with your own env variable mechanism.

import humps from 'humps';
import { AxiosRequestConfig } from 'axios';

const VENDOR_API_KEY = process.env.VUE_APP_VENDOR_API_KEY;
const VENDOR_API_SECRET_KEY = process.env.VUE_APP_VENDOR_API_SECRET_KEY;

export async function generateToken(
  request: AxiosRequestConfig,
  apiKey?: string,
  apiSecretKey?: string
): Promise<string> {
  const httpMethod = request.method ? request.method.toUpperCase() : 'GET';
  const url = new URL(request.url as string);
  const searchParams = new URLSearchParams(url.search);
  searchParams.set('client_type', 'web');
  url.search = searchParams.toString();
  const path = url.pathname + url.search;
  const currentTime = new Date().getTime().toString();

  const body = httpMethod === 'GET' ? '' : request.data ? JSON.stringify(humps.decamelizeKeys(request.data)) : '';
  const rawSignature = `${currentTime}\r\n${httpMethod}\r\n${path}\r\n\r\n${body}`;

  apiKey = apiKey || VENDOR_API_KEY;
  apiSecretKey = apiSecretKey || VENDOR_API_SECRET_KEY;

  if (!apiKey || !apiSecretKey) {
    throw new Error('API key and/or secret key not provided');
  }

  const CryptoJS = await import('crypto-js');
  const signature = CryptoJS.HmacSHA256(rawSignature, apiSecretKey).toString();
  return `hmac ${apiKey}:${currentTime}:${signature}`;
}

Usage example with Axios

const token = await generateToken({ method: 'GET', url: 'https://api.vendor.com/v1/orders' });

await axios.get('https://api.vendor.com/v1/orders', {
  headers: {
    Authorization: token,
  },
});

Generate using Postman

To generate an auth token using Postman, add this script to Pre-request Script:

const httpMethod = pm.request.method;
const apiKey = pm.environment.get('API_KEY');
const apiSecretKey = pm.environment.get('API_SECRET_KEY');

const currentTime = new Date().getTime().toString();
const path = pm.variables.replaceIn(pm.request.url.getPathWithQuery());

let body = '';
if (httpMethod !== 'GET') {
  body = pm.request.body.raw || '';
}

const rawSignature = `${currentTime}\r\n${httpMethod}\r\n${path}\r\n\r\n${body}`;
const signature = CryptoJS.HmacSHA256(rawSignature, apiSecretKey).toString();
const token = `hmac ${apiKey}:${currentTime}:${signature}`;

pm.environment.set('API_TOKEN', token);
pm.request.headers.add({ key: 'Authorization', value: token });

Troubleshooting

• Missing keys: ensure API_KEY and API_SECRET_KEY are set.
• Signature mismatch: verify path/query/body are exactly the same as request payload.
• Clock skew: ensure system time is synced.