Authentication

# Export KINTRA_API for your environment first; the base URL is on the introduction page.
KEY="YOUR_TENANT_KEY_ID"
SECRET="YOUR_SIGNING_SECRET"

# The signature covers the path and query exactly as sent, so both are split
# off the base URL and reused for the request line below.
API_PATH="/${KINTRA_API#*://*/}"
API_HOST="${KINTRA_API%"$API_PATH"}"
METHOD="GET"
PATH_AND_QUERY="$API_PATH/gateway/customers"

# No body on this method, so the signature covers an empty body string.
BODY=''

TIMESTAMP="$(date +%s)"
SIGNATURE="$(printf '%s' "$TIMESTAMP$METHOD$PATH_AND_QUERY$BODY" \
  | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $NF}')"

curl -sS -w '\n%{http_code}' -X "$METHOD" "$API_HOST$PATH_AND_QUERY" \
  -H "X-Tenant-Key: $KEY" \
  -H "X-Tenant-Timestamp: $TIMESTAMP" \
  -H "X-Tenant-Signature: $SIGNATURE"

import { createHmac } from 'node:crypto'

// Export KINTRA_API for your environment first; the base URL is on the introduction page.
const { origin, pathname } = new URL(process.env.KINTRA_API ?? '')
const key = 'YOUR_TENANT_KEY_ID'
const secret = 'YOUR_SIGNING_SECRET'

const method = 'GET'
// The signature covers the path and query as sent, starting at the API prefix.
const pathAndQuery = `${pathname}/gateway/customers`

// No body on this method, so the signature covers an empty body string.
const body = ''

const timestamp = Math.floor(Date.now() / 1000).toString()
const signature = createHmac('sha256', secret).update(`${timestamp}${method}${pathAndQuery}${body}`).digest('hex')

const response = await fetch(`${origin}${pathAndQuery}`, {
  method,
  headers: {
    'X-Tenant-Key': key,
    'X-Tenant-Timestamp': timestamp,
    'X-Tenant-Signature': signature
  }
})

console.log(response.status, await response.json())