商户 API 签名认证说明

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.SecureRandom;
import java.time.Instant;

public class ApiClient {

    public static void main(String[] args) throws Exception {
        String accessKey = "your-access-key";
        String secret = "your-api-secret";

        String url = "https://api.example.com/api/v1/game/user-create";
        String path = "/api/v1/game/user-create";

        String body = """
                {"username":"test001","nickname":"测试用户"}
                """.trim();

        String method = "POST";

        String timestamp = String.valueOf(Instant.now().getEpochSecond());

        String nonce = randomNonce();

        // SHA256(body)
        String bodyHash = sha256(body);

        // 构造签名原文
        String signString =
                method.toUpperCase() + "\n" +
                path + "\n" +
                timestamp + "\n" +
                nonce + "\n" +
                bodyHash;

        // HMAC-SHA256
        String signature = hmacSha256(signString, secret);

        HttpClient client = HttpClient.newHttpClient();

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create(url))
                .header("Content-Type", "application/json")
                .header("X-Access-Key", accessKey)
                .header("X-Timestamp", timestamp)
                .header("X-Nonce", nonce)
                .header("X-Signature", signature)
                .POST(HttpRequest.BodyPublishers.ofString(
                        body,
                        StandardCharsets.UTF_8
                ))
                .build();

        HttpResponse<String> response = client.send(
                request,
                HttpResponse.BodyHandlers.ofString()
        );

        System.out.println(response.statusCode());
        System.out.println(response.body());
    }

    /**
     * SHA-256
     */
    private static String sha256(String data) throws Exception {
        MessageDigest digest = MessageDigest.getInstance("SHA-256");

        byte[] hash = digest.digest(
                data.getBytes(StandardCharsets.UTF_8)
        );

        return hex(hash);
    }

    /**
     * HMAC-SHA256
     */
    private static String hmacSha256(
            String data,
            String secret
    ) throws Exception {

        Mac mac = Mac.getInstance("HmacSHA256");

        SecretKeySpec key = new SecretKeySpec(
                secret.getBytes(StandardCharsets.UTF_8),
                "HmacSHA256"
        );

        mac.init(key);

        byte[] hash = mac.doFinal(
                data.getBytes(StandardCharsets.UTF_8)
        );

        return hex(hash);
    }

    /**
     * 生成随机 nonce
     */
    private static String randomNonce() {
        byte[] bytes = new byte[16];
        new SecureRandom().nextBytes(bytes);
        return hex(bytes);
    }

    /**
     * byte[] -> 小写十六进制
     */
    private static String hex(byte[] bytes) {
        StringBuilder sb = new StringBuilder(bytes.length * 2);

        for (byte b : bytes) {
            sb.append(String.format("%02x", b));
        }

        return sb.toString();
    }
}