Auth Header Signing in Node.js -ONDC

This article is dedicated to those who just started their participation in the ONDC and are in looking for generating header signatures on their own.

I have also written an article on auth generation using python. This article is for those who are trying to build the same using node.js

The first thing that we need to understand is the library that can help us in generating the auth signature — libsodium-wrappers

This is the library used for generating the signed authorization signature. You can use the below snippet to import the library into your code.

Authorization Header generation cosist of 3 steps:

1. Generation of Digest of the payload in the format specified by Beckn
2. Signing of the digest using a Private key
3. Preparing the Authorization header in the format specified by Beckn

Let’s start the process of Authorization header generation.

Generate the keypair using libsodium-wrapper.

As per the Beckn specifications, the Authorization header digest format is as below :

This is the sample code that can be used to create a digest as above.

The above function generates the digest of the request body using the BLAKE-512 hashing function. The JSON request body (payload) should be stringified before hashing.

crypto_generichash() of libsodium is used to create a digest from the string as below.

The ‘created’ field expresses when the signature was created. The value MUST be a Unix timestamp integer value. A signature with a ‘created’ timestamp value that is in the future MUST NOT be processed.

The ‘expires’ field expresses when the signature ceases to be valid. The value MUST be a Unix timestamp integer value. A signature with an ‘expires’ timestamp value that is in the past MUST NOT be processed.

Get Vikram Acharya’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Concatenate the three values, i.e the ‘created’, ‘expires’, and ‘digest’ in the format as shown below. The string is the signing string that the BAP is going to use to sign the request

Every line in the signing string must end with a new line. All 3 components digest, created, and expires should be in their own lines.

Once the digest(signing_string) is created, we will sign it using the private key. The below code can be used to sign the digest(signing_string) created above.

For signing digest crypto_sign_detached() of libsodium is used.

Now as the signed message is available, format it as per the Beckn Specification to create the authorization header.

The authorization header should be created in the below formats :

The below function creates the authorization header as per the format.

The message in the above function is the body of the request (payload).

You will need to define unique_key_id and bap_id in config to be used in the above function.

That’s it. This needs to be sent as Authorization or Proxy-Authorization header as per the formats given.

You can also verify the message that was signed using the corresponding public key with the below function :

For every request received the authorization header should be verified using the sender’s public key.

reference: Signing Beckn APIs in HTTP by Beckn