API Access

const { createHash, createHmac } = require('node:crypto');

// Supply the exact encoded path/query and the same bytes you send over HTTP.
function signRequest({ secretBase64url, method, rawPath, rawQueryString = '', body = Buffer.alloc(0), timestamp = String(Math.floor(Date.now() / 1000)) }) {
  if (typeof secretBase64url !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(secretBase64url)) throw new Error('Expected a 32-byte base64url secret');
  const secret = Buffer.from(secretBase64url, 'base64url');
  try {
    if (secret.length !== 32 || secret.toString('base64url') !== secretBase64url) throw new Error('Invalid base64url secret');
    if (!Buffer.isBuffer(body)) throw new Error('body must be the exact request Buffer');
    if (!/^(0|[1-9][0-9]*)$/.test(timestamp) || !Number.isSafeInteger(Number(timestamp))) throw new Error('Invalid timestamp');
    if (!/^[A-Za-z]+$/.test(method) || !rawPath.startsWith('/') || /[\r\n]/.test(rawPath + rawQueryString)) throw new Error('Invalid request target');
    const canonical = ['CW1', timestamp, method.toUpperCase(), rawPath, rawQueryString, createHash('sha256').update(body).digest('hex')].join('\n');
    return { 'x-cw-timestamp': timestamp, 'x-cw-signature': 'v1=' + createHmac('sha256', secret).update(canonical, 'utf8').digest('hex') };
  } finally { secret.fill(0); }
}
module.exports = { signRequest };

"""Standard-library signing helper. Does not send requests or log credentials."""
import base64
import hashlib
import hmac
import re
import time


def sign_request(secret_base64url, method, raw_path, raw_query_string="", body=b"", timestamp=None):
    """Sign the exact encoded request target and bytes that will be sent."""
    timestamp = str(int(time.time())) if timestamp is None else timestamp
    if not isinstance(secret_base64url, str) or not re.fullmatch(r"[A-Za-z0-9_-]{43}", secret_base64url):
        raise ValueError("Expected a 32-byte base64url secret")
    secret = base64.urlsafe_b64decode(secret_base64url + "=")
    if len(secret) != 32 or base64.urlsafe_b64encode(secret).decode().rstrip("=") != secret_base64url:
        raise ValueError("Invalid base64url secret")
    if not isinstance(body, bytes):
        raise ValueError("body must be the exact request bytes")
    if not isinstance(timestamp, str) or not re.fullmatch(r"0|[1-9][0-9]*", timestamp) or int(timestamp) > 9007199254740991:
        raise ValueError("Invalid timestamp")
    if not re.fullmatch(r"[A-Za-z]+", method) or not raw_path.startswith("/") or re.search(r"[\r\n]", raw_path + raw_query_string):
        raise ValueError("Invalid request target")
    canonical = "\n".join(["CW1", timestamp, method.upper(), raw_path, raw_query_string, hashlib.sha256(body).hexdigest()])
    return {"x-cw-timestamp": timestamp, "x-cw-signature": "v1=" + hmac.new(secret, canonical.encode("utf-8"), hashlib.sha256).hexdigest()}