Authentication

myntkaup-public-v1
<MK-Key-Id>
<MK-Timestamp>
<MK-Nonce>
<METHOD>
<path and query>
<SHA-256 of the body, lowercase hex>

// Signs a Myntkaup API request with nothing but node:crypto (Node 18 or later).
// test/samples.test.ts checks it against packages/signing/test-vectors.json.
import { createHash, createPrivateKey, randomBytes, sign } from "node:crypto";

// Turns the 32-byte seed in mk_sk_… into a PKCS #8 key Node can load.
const PKCS8_ED25519_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");

/**
 * The four MK-* headers for one request. `body` must be the exact string or
 * bytes you send; leave it empty for a GET.
 */
export function signHeaders({
  keyId,
  privateKey,
  method,
  pathAndQuery,
  body = "",
  timestamp = Date.now(),
  nonce = randomBytes(16).toString("hex"),
}) {
  const seed = Buffer.from(privateKey.replace(/^mk_sk_/, ""), "base64url");
  const key = createPrivateKey({
    key: Buffer.concat([PKCS8_ED25519_PREFIX, seed]),
    format: "der",
    type: "pkcs8",
  });
  const canonical = [
    "myntkaup-public-v1",
    keyId,
    String(timestamp),
    nonce,
    method.toUpperCase(),
    pathAndQuery,
    createHash("sha256").update(body).digest("hex"),
  ].join("\n");
  return {
    "MK-Key-Id": keyId,
    "MK-Timestamp": String(timestamp),
    "MK-Nonce": nonce,
    "MK-Signature": sign(null, Buffer.from(canonical, "utf8"), key).toString("base64"),
  };
}

import { signHeaders } from "./sign-headers.mjs";

const body = JSON.stringify({ asset: "BTC", side: "buy", quote_amount: "100.00" });
const headers = signHeaders({
  keyId: process.env.MYNTKAUP_API_KEY_ID,
  privateKey: process.env.MYNTKAUP_API_PRIVATE_KEY,
  method: "POST",
  pathAndQuery: "/v1/quotes",
  body,
});
const response = await fetch("https://public-api.myntkaup.is/v1/quotes", {
  method: "POST",
  headers: { ...headers, "Content-Type": "application/json" },
  body,
});

"""Signs a Myntkaup API request with the `cryptography` package (Python 3.9+).

test/samples.test.ts checks it against packages/signing/test-vectors.json.
"""

import base64
import hashlib
import secrets
import time

from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey


def sign_headers(key_id, private_key, method, path_and_query, body=b"", timestamp=None, nonce=None):
    """Returns the four MK-* headers. `body` must be the exact bytes you send."""
    if isinstance(body, str):
        body = body.encode("utf-8")
    seed = base64.urlsafe_b64decode(private_key.removeprefix("mk_sk_") + "=")
    key = Ed25519PrivateKey.from_private_bytes(seed)
    timestamp = str(timestamp if timestamp is not None else int(time.time() * 1000))
    nonce = nonce or secrets.token_hex(16)
    canonical = "\n".join(
        [
            "myntkaup-public-v1",
            key_id,
            timestamp,
            nonce,
            method.upper(),
            path_and_query,
            hashlib.sha256(body).hexdigest(),
        ]
    )
    signature = base64.b64encode(key.sign(canonical.encode("utf-8"))).decode("ascii")
    return {
        "MK-Key-Id": key_id,
        "MK-Timestamp": timestamp,
        "MK-Nonce": nonce,
        "MK-Signature": signature,
    }

import json
import os

import httpx

from sign_headers import sign_headers

body = json.dumps({"asset": "BTC", "side": "buy", "quote_amount": "100.00"}, separators=(",", ":"))
headers = sign_headers(
    os.environ["MYNTKAUP_API_KEY_ID"],
    os.environ["MYNTKAUP_API_PRIVATE_KEY"],
    "POST",
    "/v1/quotes",
    body,
)
response = httpx.post(
    "https://public-api.myntkaup.is/v1/quotes",
    content=body,  # the signed bytes; json= would serialize them again
    headers={**headers, "Content-Type": "application/json"},
)

chmod +x sign-headers.sh
set -a; . ./.env; set +a   # MYNTKAUP_API_KEY_ID and MYNTKAUP_API_PRIVATE_KEY

curl https://public-api.myntkaup.is/v1/me $(./sign-headers.sh GET /v1/me | sed 's/^/-H /')

body='{"asset":"BTC","side":"buy","quote_amount":"100.00"}'
curl https://public-api.myntkaup.is/v1/quotes \
  -H "Content-Type: application/json" \
  $(./sign-headers.sh POST /v1/quotes "$body" | sed 's/^/-H /') \
  --data "$body"

#!/usr/bin/env bash
# Prints the four MK-* headers for a request, with nothing but OpenSSL 3 and
# coreutils: the shell version of packages/signing (contract section 1).
#
# The key is read from MYNTKAUP_API_KEY_ID and MYNTKAUP_API_PRIVATE_KEY, the
# names in the .env file the webapp gives you (MK_KEY_ID / MK_PRIVATE_KEY
# still work):
#
#   export MYNTKAUP_API_KEY_ID=mk_test_… MYNTKAUP_API_PRIVATE_KEY=mk_sk_…
#   scripts/sign-headers.sh GET /v1/me
#   curl https://public-api.staging.myntkaup.is/v1/me $(scripts/sign-headers.sh GET /v1/me | sed 's/^/-H /')   # values have no spaces
#
# Sign the exact body bytes you send. MK_TIMESTAMP and MK_NONCE may be set to
# reproduce the test vectors.
set -euo pipefail
OPENSSL="${OPENSSL:-openssl}"
method="$1" path="$2" body="${3:-}"
key_id="${MYNTKAUP_API_KEY_ID:-${MK_KEY_ID:?set MYNTKAUP_API_KEY_ID}}"
private_key="${MYNTKAUP_API_PRIVATE_KEY:-${MK_PRIVATE_KEY:?set MYNTKAUP_API_PRIVATE_KEY}}"
timestamp="${MK_TIMESTAMP:-$(( $(date +%s) * 1000 ))}"
nonce="${MK_NONCE:-$("$OPENSSL" rand -hex 16)}"
key="$(mktemp)"; msg="$(mktemp)"; trap 'rm -f "$key" "$msg"' EXIT
{ printf '302e020100300506032b657004220420' | xxd -r -p
  printf '%s=' "${private_key#mk_sk_}" | tr '_-' '/+' | base64 -d; } > "$key"
body_hash="$(printf '%s' "$body" | "$OPENSSL" dgst -sha256 -r | cut -d' ' -f1)"
printf 'myntkaup-public-v1\n%s\n%s\n%s\n%s\n%s\n%s' "$key_id" "$timestamp" "$nonce" "$method" "$path" "$body_hash" > "$msg"
signature="$("$OPENSSL" pkeyutl -sign -inkey "$key" -keyform DER -rawin -in "$msg" | base64 | tr -d '\n')"
echo "MK-Key-Id:$key_id"
echo "MK-Timestamp:$timestamp"
echo "MK-Nonce:$nonce"
echo "MK-Signature:$signature"