API Security

NOTE:

Read this chapter if you're going to use REST API. If you're going to use SDK library, you may keep going to next artticle.

Navigation:

Security Headers
Request Signature
Signature Generation Algorithm

Security Headers

Each request to MoneyMade Connect User API should contain following protection headers:

x-mm-api-key- the API key you received from our developers
x-mm-request-timestamp - current time as timestamp (in milliseconds). E.g. for date '2022-04-28T11:02:12.876Z' it equals to 1651143732876
x-mm-request-signature - request signature.

Request Signature

To sign a request you need following parameters:

Parameter	Description	Example
request timestamp	Request timestamp you set into x-mm-request-timestamp header. It's used as typical nonce. It should be timestamp with milliseconds.	1651143732876
secret key	The secret key you received from MoneyMade team.	SECRET_KEY_VALUE
request body	The request body JSON string encoded as base64.	{"client_user_id":"my-internal-id"}
request url	Full request url.	https://connect-account-api.moneymade.io

Signature Generation Algorithm:

Concat timestamp + request url+ request body
Create sha256 HMAC (use secret key as encryption key)
Transform it to HEX digest

import * as crypto from 'crypto';

export interface SignatureComponents {
  secretKey: string;
  body: any;
  requestUrl: string;
  timestamp: number;
}

export const makeSign = (params: SignatureComponents) => {
  const { requestUrl, timestamp } = params;
  const bodyPayload = params.body ? JSON.stringify(params.body) : '';
  const hmacBody = timestamp + requestUrl + bodyPayload;
 
  return crypto
    .createHmac('sha256', params.secretKey)
    .update(Buffer.from(hmacBody))
    .digest('hex');
}

const crypto = require('crypto');


export const makeSign = (params) => {
  const { requestUrl, timestamp } = params;
  const bodyPayload = params.body ? JSON.stringify(params.body) : '';
  const hmacBody = timestamp + requestUrl + bodyPayload;
 
  return crypto
    .createHmac('sha256', params.secretKey)
    .update(Buffer.from(hmacBody))
    .digest('hex');
}