Authentication

Yumbi Gateway authenticates requests using an HMAC-SHA256 signature. To generate this signature, the API key is used as the secret key, and the signature is created from the request's full path, body, and timestamp.

Once the signature is calculated, include it in the X-HMAC header of your request. Additionally, ensure the following headers are included:

X-Timestamp: Contains the timestamp used in the signature calculation.
X-Client-Id: Contains your client ID.

These headers help authenticate and validate the request.

1. Calculate the HMAC signature

public static string CalculateHmac(string apiKey, string path, string serializedContent, string timestamp, string queryString = "")
{
    var pathAndQuery = $"{path}{(string.IsNullOrEmpty(queryString) ? "" : $"?{queryString}")}";

    var payload = $"{pathAndQuery}{serializedContent}{timestamp}";

    using (var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(apiKey)))
    {
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(payload));
        return BitConverter.ToString(hash).Replace("-", "").ToLower();
    }
}

2. Get the current time in Unix timestamp format

public static string GetUnixTimestampInSeconds() => DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString();

3. Send a request with the calculated HMAC signature

static async Task Main()
{
    var apiKey = "7da40deb9ed90811ce9bca0f5636d23c";
    var clientId = "testapp_id";
    var path = "/api/v1/webhooks";
    var serializedContent = "{\"url\":\"https://example.com\"}";
    
    // Generate timestamp
    var timestamp = GetUnixTimestampInSeconds();

    // Calculate HMAC
    var hmac = CalculateHmac(apiKey, path, serializedContent, timestamp);

    using (var client = new HttpClient())
    {
        client.DefaultRequestHeaders.Add("X-HMAC", hmac);
        client.DefaultRequestHeaders.Add("X-Client-Id", clientId);
        client.DefaultRequestHeaders.Add("X-Timestamp", timestamp);

        // Send a POST request
        var content = new StringContent(serializedContent, Encoding.UTF8, "application/json");
        var response = await client.PostAsync($"https://gateway-za.yumbidemo.com{path}", content);

        // Output the response
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }
}

15 May 2025