Authentication

const crypto = require('crypto');

const MERCHANT_ID = 'MER_2aUyqjCzEIiEcYMKj7TZtw';
const PRIVATE_KEY = `-----BEGIN RSA PRIVATE KEY-----
...your private key...
-----END RSA PRIVATE KEY-----`;

async function callApiWithSignature(method, path, body) {
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const bodyStr = JSON.stringify(body);
  const bodyHash = crypto.createHash('sha256').update(bodyStr).digest('base64');

  // Build canonical request
  const canonicalRequest = `${method}\n${path}\n${timestamp}\n${bodyHash}`;

  // RSA-SHA256 sign
  const signature = crypto.sign('sha256', Buffer.from(canonicalRequest), PRIVATE_KEY).toString('base64');

  const response = await fetch(`https://api.waffo.ai${path}`, {
    method,
    headers: {
      'Content-Type': 'application/json',
      'X-Merchant-Id': MERCHANT_ID,
      'X-Timestamp': timestamp,
      'X-Signature': signature
    },
    body: bodyStr
  });

  return response.json();
}

// Usage
const result = await callApiWithSignature('POST', '/v1/actions/store/create-store', {
  name: 'My Store'
});

MERCHANT_ID="MER_2aUyqjCzEIiEcYMKj7TZtw"
TIMESTAMP=$(date +%s)
BODY='{"name":"My Store"}'
BODY_HASH=$(echo -n "$BODY" | openssl dgst -sha256 -binary | base64 -w 0)
CANONICAL_REQUEST="POST
/v1/actions/store/create-store
$TIMESTAMP
$BODY_HASH"

# Sign with openssl (requires private_key.pem file)
SIGNATURE=$(echo -n "$CANONICAL_REQUEST" | openssl dgst -sha256 -sign private_key.pem | base64 -w 0)

curl -X POST "https://api.waffo.ai/v1/actions/store/create-store" \
  -H "Content-Type: application/json" \
  -H "X-Merchant-Id: $MERCHANT_ID" \
  -H "X-Timestamp: $TIMESTAMP" \
  -H "X-Signature: $SIGNATURE" \
  -d "$BODY"

import hashlib
import time
import base64
import json
import requests
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding

MERCHANT_ID = 'MER_2aUyqjCzEIiEcYMKj7TZtw'
PRIVATE_KEY = '''-----BEGIN RSA PRIVATE KEY-----
...your private key...
-----END RSA PRIVATE KEY-----'''

def call_api_with_signature(method, path, body):
    timestamp = str(int(time.time()))
    body_str = json.dumps(body, separators=(',', ':'))
    body_hash = base64.b64encode(hashlib.sha256(body_str.encode()).digest()).decode()

    # Build canonical request
    canonical_request = f"{method}\n{path}\n{timestamp}\n{body_hash}"

    # RSA-SHA256 sign
    private_key = serialization.load_pem_private_key(PRIVATE_KEY.encode(), password=None)
    signature = private_key.sign(canonical_request.encode(), padding.PKCS1v15(), hashes.SHA256())
    signature_b64 = base64.b64encode(signature).decode()

    response = requests.post(
        f'https://api.waffo.ai{path}',
        headers={
            'Content-Type': 'application/json',
            'X-Merchant-Id': MERCHANT_ID,
            'X-Timestamp': timestamp,
            'X-Signature': signature_b64
        },
        data=body_str
    )

    return response.json()

# Usage
result = call_api_with_signature('POST', '/v1/actions/store/create-store', {
    'name': 'My Store'
})

curl -X POST https://api.waffo.ai/v1/actions/checkout/create-session \
  -H "X-Store-Slug: my-awesome-store-k8x2m9ab" \
  -H "X-Environment: test" \
  -H "Content-Type: application/json" \
  -d '{"productId": "PROD_4cWAslE1GKkGeaOMl9Vbmy", "productType": "onetime", "currency": "USD"}'

const response = await fetch('https://api.waffo.ai/v1/graphql', {
  method: 'POST',
  headers: {
    'X-Store-Slug': 'my-awesome-store-k8x2m9ab',
    'Content-Type': 'application/json',
    'X-Environment': 'prod'
  },
  body: JSON.stringify({
    query: `query { store { id name onetimeProducts { id name prices } } }`
  })
});