Signing requests

// Node.js 18+ — no dependencies
import crypto from 'node:crypto';
import fs from 'node:fs';

const BASE_URL = 'https://test.lintaspay.xyz';
const APP_ID = 'your_app_id';
const PRIVATE_KEY = fs.readFileSync('merchant_private_key.pem', 'utf8');
const PLATFORM_PUBLIC_KEY = fs.readFileSync('lintaspay_public_key.pem', 'utf8');

export async function call(path, body) {
  const raw = JSON.stringify(body);
  const authString = `app_id=${APP_ID},nonce=${crypto.randomBytes(16).toString('hex')},timestamp=${Date.now()}`;
  const content = `${authString}\nPOST\n${path}\n${raw}\n`;
  const sign = crypto.sign('RSA-SHA256', Buffer.from(content), PRIVATE_KEY).toString('base64');

  const res = await fetch(BASE_URL + path, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      Authorization: `LINTASPAY-SHA256withRSA ${authString},sign=${sign}`,
      'lintaspay-request-id': crypto.randomUUID().replaceAll('-', ''),
    },
    body: raw,
  });
  const text = await res.text();

  // Verify the response signature before trusting it.
  const signed = `${res.headers.get('lintaspay-timestamp')}\n${res.headers.get('lintaspay-nonce')}\n${text}\n`;
  const valid = crypto.verify('RSA-SHA256', Buffer.from(signed), PLATFORM_PUBLIC_KEY,
    Buffer.from(res.headers.get('lintaspay-signature') ?? '', 'base64'));
  if (!valid) throw new Error('invalid response signature');
  return JSON.parse(text);
}

# Python 3.9+ — pip install requests cryptography
import base64, json, time, uuid
import requests
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding

BASE_URL = "https://test.lintaspay.xyz"
APP_ID = "your_app_id"
with open("merchant_private_key.pem", "rb") as f:
    PRIVATE_KEY = serialization.load_pem_private_key(f.read(), password=None)
with open("lintaspay_public_key.pem", "rb") as f:
    PLATFORM_PUBLIC_KEY = serialization.load_pem_public_key(f.read())


def call(path: str, body: dict) -> dict:
    raw = json.dumps(body, separators=(",", ":"), ensure_ascii=False)
    auth = f"app_id={APP_ID},nonce={uuid.uuid4().hex},timestamp={int(time.time() * 1000)}"
    content = f"{auth}\nPOST\n{path}\n{raw}\n".encode()
    sign = base64.b64encode(PRIVATE_KEY.sign(content, padding.PKCS1v15(), hashes.SHA256())).decode()

    res = requests.post(BASE_URL + path, data=raw.encode(), timeout=30, headers={
        "Content-Type": "application/json",
        "Authorization": f"LINTASPAY-SHA256withRSA {auth},sign={sign}",
        "lintaspay-request-id": uuid.uuid4().hex,
    })
    text = res.content.decode("utf-8")

    # Verify the response signature before trusting it (raises InvalidSignature).
    signed = f"{res.headers['lintaspay-timestamp']}\n{res.headers['lintaspay-nonce']}\n{text}\n".encode()
    PLATFORM_PUBLIC_KEY.verify(base64.b64decode(res.headers["lintaspay-signature"]), signed,
                               padding.PKCS1v15(), hashes.SHA256())
    return json.loads(text)

<?php
// PHP 7.4+ with openssl and curl
const BASE_URL = 'https://test.lintaspay.xyz';
const APP_ID = 'your_app_id';

function api_call(string $path, $body): array
{
    static $privateKey, $platformKey;
    $privateKey ??= openssl_pkey_get_private(file_get_contents('merchant_private_key.pem'));
    $platformKey ??= openssl_pkey_get_public(file_get_contents('lintaspay_public_key.pem'));

    $raw = json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    $auth = sprintf('app_id=%s,nonce=%s,timestamp=%d', APP_ID, bin2hex(random_bytes(16)), (int) (microtime(true) * 1000));
    openssl_sign("$auth\nPOST\n$path\n$raw\n", $signature, $privateKey, OPENSSL_ALGO_SHA256);

    $headers = [];
    $ch = curl_init(BASE_URL . $path);
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => $raw,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 30,
        CURLOPT_HTTPHEADER => [
            'Content-Type: application/json',
            'Authorization: LINTASPAY-SHA256withRSA ' . $auth . ',sign=' . base64_encode($signature),
            'lintaspay-request-id: ' . bin2hex(random_bytes(16)),
        ],
        CURLOPT_HEADERFUNCTION => function ($ch, $line) use (&$headers) {
            $parts = explode(':', $line, 2);
            if (count($parts) === 2) {
                $headers[strtolower(trim($parts[0]))] = trim($parts[1]);
            }
            return strlen($line);
        },
    ]);
    $text = curl_exec($ch);
    curl_close($ch);

    // Verify the response signature before trusting it.
    $signed = $headers['lintaspay-timestamp'] . "\n" . $headers['lintaspay-nonce'] . "\n" . $text . "\n";
    if (openssl_verify($signed, base64_decode($headers['lintaspay-signature'] ?? ''), $platformKey, OPENSSL_ALGO_SHA256) !== 1) {
        throw new RuntimeException('invalid response signature');
    }
    return json_decode($text, true);
}

// Java 11+ — no dependencies. Private key must be PKCS8 PEM.
import java.net.URI;
import java.net.http.*;
import java.nio.charset.StandardCharsets;
import java.nio.file.*;
import java.security.*;
import java.security.spec.*;
import java.util.*;

public class ApiClient {
    static final String BASE_URL = "https://test.lintaspay.xyz";
    static final String APP_ID = "your_app_id";

    private final PrivateKey privateKey;
    private final PublicKey platformKey;
    private final HttpClient http = HttpClient.newHttpClient();

    public ApiClient() throws Exception {
        KeyFactory kf = KeyFactory.getInstance("RSA");
        privateKey = kf.generatePrivate(new PKCS8EncodedKeySpec(pem("merchant_private_key.pem")));
        platformKey = kf.generatePublic(new X509EncodedKeySpec(pem("lintaspay_public_key.pem")));
    }

    static byte[] pem(String file) throws Exception {
        String body = Files.readString(Path.of(file)).replaceAll("-----[A-Z ]+-----", "").replaceAll("\\s", "");
        return Base64.getDecoder().decode(body);
    }

    /** POSTs rawJson to path; returns the verified response body. */
    public String call(String path, String rawJson) throws Exception {
        String auth = "app_id=" + APP_ID + ",nonce=" + UUID.randomUUID().toString().replace("-", "")
                + ",timestamp=" + System.currentTimeMillis();
        Signature s = Signature.getInstance("SHA256withRSA");
        s.initSign(privateKey);
        s.update((auth + "\nPOST\n" + path + "\n" + rawJson + "\n").getBytes(StandardCharsets.UTF_8));
        String sign = Base64.getEncoder().encodeToString(s.sign());

        HttpRequest req = HttpRequest.newBuilder(URI.create(BASE_URL + path))
                .header("Content-Type", "application/json")
                .header("Authorization", "LINTASPAY-SHA256withRSA " + auth + ",sign=" + sign)
                .header("lintaspay-request-id", UUID.randomUUID().toString().replace("-", ""))
                .POST(HttpRequest.BodyPublishers.ofString(rawJson, StandardCharsets.UTF_8))
                .build();
        HttpResponse<String> res = http.send(req, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));

        // Verify the response signature before trusting it.
        String signed = res.headers().firstValue("lintaspay-timestamp").orElse("") + "\n"
                + res.headers().firstValue("lintaspay-nonce").orElse("") + "\n" + res.body() + "\n";
        Signature v = Signature.getInstance("SHA256withRSA");
        v.initVerify(platformKey);
        v.update(signed.getBytes(StandardCharsets.UTF_8));
        if (!v.verify(Base64.getDecoder().decode(res.headers().firstValue("lintaspay-signature").orElse("")))) {
            throw new SecurityException("invalid response signature");
        }
        return res.body();
    }
}