Autenticacao HMAC

<METHOD em uppercase>\n
<path absoluto sem query string>\n
<valor de Idempotency-Key>\n
<valor de X-Timestamp>\n
<sha256(body) em hex lowercase>

POST
/api/v1/pix
550e8400-e29b-41d4-a716-446655440000
2026-04-26T14:30:00Z
<sha256-hex-do-body>

#!/usr/bin/env bash
set -euo pipefail

URL="https://api.example.com/api/v1/pix"
CLIENT_ID="cnab-uau"
SECRET="${CNAB_UAU_HMAC_SECRET:?defina CNAB_UAU_HMAC_SECRET}"

BODY='{"dataLancamento":"2026-04-26","valor":1.00,"tipoChave":"CHAVE_PIX_EMAIL","chavePix":"a@b.com"}'
TS=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
IK=$(uuidgen | tr '[:upper:]' '[:lower:]')

BODY_HASH=$(printf '%s' "$BODY" | openssl dgst -sha256 -hex | awk '{print $2}')
CANONICAL=$(printf 'POST\n/api/v1/pix\n%s\n%s\n%s' "$IK" "$TS" "$BODY_HASH")
SIG=$(printf '%s' "$CANONICAL" | openssl dgst -sha256 -hmac "$SECRET" -hex | awk '{print $2}')

curl -sS -X POST "$URL" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $IK" \
  -H "X-Client-Id: $CLIENT_ID" \
  -H "X-Timestamp: $TS" \
  -H "X-Signature: hmac-sha256=$SIG" \
  --data-raw "$BODY"

import hashlib, hmac, json, os, uuid, datetime, urllib.request

URL = "https://api.example.com/api/v1/pix"
CLIENT_ID = "cnab-uau"
SECRET = os.environ["CNAB_UAU_HMAC_SECRET"].encode("utf-8")

payload = {
    "dataLancamento": "2026-04-26",
    "valor": 1.00,
    "tipoChave": "CHAVE_PIX_EMAIL",
    "chavePix": "a@b.com",
}
body_bytes = json.dumps(payload, separators=(",", ":")).encode("utf-8")

idempotency_key = str(uuid.uuid4())
timestamp = datetime.datetime.now(
    datetime.timezone.utc
).strftime("%Y-%m-%dT%H:%M:%SZ")

body_hash = hashlib.sha256(body_bytes).hexdigest()
canonical = f"POST\n/api/v1/pix\n{idempotency_key}\n{timestamp}\n{body_hash}"
signature = hmac.new(
    SECRET, canonical.encode("utf-8"), hashlib.sha256
).hexdigest()

req = urllib.request.Request(
    URL,
    data=body_bytes,
    method="POST",
    headers={
        "Content-Type": "application/json",
        "Idempotency-Key": idempotency_key,
        "X-Client-Id": CLIENT_ID,
        "X-Timestamp": timestamp,
        "X-Signature": f"hmac-sha256={signature}",
    },
)
with urllib.request.urlopen(req) as resp:
    print(resp.status, resp.read().decode())

import crypto from "node:crypto";
import { randomUUID } from "node:crypto";

const URL_API = "https://api.example.com/api/v1/pix";
const CLIENT_ID = "cnab-uau";
const SECRET = process.env.CNAB_UAU_HMAC_SECRET;

const payload = {
  dataLancamento: "2026-04-26",
  valor: 1.0,
  tipoChave: "CHAVE_PIX_EMAIL",
  chavePix: "a@b.com",
};
const bodyString = JSON.stringify(payload);

const idempotencyKey = randomUUID();
const timestamp = new Date().toISOString().replace(/\.\d{3}Z$/, "Z");

const bodyHash = crypto
  .createHash("sha256")
  .update(bodyString, "utf8")
  .digest("hex");
const canonical = `POST\n/api/v1/pix\n${idempotencyKey}\n${timestamp}\n${bodyHash}`;
const signature = crypto
  .createHmac("sha256", SECRET)
  .update(canonical, "utf8")
  .digest("hex");

const resp = await fetch(URL_API, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Idempotency-Key": idempotencyKey,
    "X-Client-Id": CLIENT_ID,
    "X-Timestamp": timestamp,
    "X-Signature": `hmac-sha256=${signature}`,
  },
  body: bodyString,
});
console.log(resp.status, await resp.text());

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;
import java.time.format.DateTimeFormatter;
import java.util.HexFormat;
import java.util.UUID;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class PixClientExample {
    public static void main(String[] args) throws Exception {
        String url = "https://api.example.com/api/v1/pix";
        String clientId = "cnab-uau";
        String secret = System.getenv("CNAB_UAU_HMAC_SECRET");

        String body = "{\"dataLancamento\":\"2026-04-26\",\"valor\":1.00,"
                    + "\"tipoChave\":\"CHAVE_PIX_EMAIL\",\"chavePix\":\"a@b.com\"}";
        byte[] bodyBytes = body.getBytes(StandardCharsets.UTF_8);

        String idempotencyKey = UUID.randomUUID().toString();
        String timestamp = DateTimeFormatter.ISO_INSTANT
                .format(Instant.now().truncatedTo(
                    java.time.temporal.ChronoUnit.SECONDS));

        HexFormat hex = HexFormat.of();
        String bodyHash = hex.formatHex(
            MessageDigest.getInstance("SHA-256").digest(bodyBytes));
        String canonical = "POST\n/api/v1/pix\n"
            + idempotencyKey + "\n" + timestamp + "\n" + bodyHash;

        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(
            secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        String signature = hex.formatHex(
            mac.doFinal(canonical.getBytes(StandardCharsets.UTF_8)));

        HttpRequest request = HttpRequest.newBuilder(URI.create(url))
                .header("Content-Type", "application/json")
                .header("Idempotency-Key", idempotencyKey)
                .header("X-Client-Id", clientId)
                .header("X-Timestamp", timestamp)
                .header("X-Signature", "hmac-sha256=" + signature)
                .POST(HttpRequest.BodyPublishers.ofByteArray(bodyBytes))
                .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
                .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

const secret = pm.environment.get("CNAB_UAU_HMAC_SECRET");
const clientId = pm.environment.get("CNAB_CLIENT_ID") || "cnab-uau";

const idempotencyKey = crypto.randomUUID();
const timestamp = new Date().toISOString().replace(/\.\d{3}Z$/, "Z");

const bodyRaw =
  pm.request.body && pm.request.body.raw ? pm.request.body.raw : "";
const bodyHash = CryptoJS.SHA256(bodyRaw).toString(CryptoJS.enc.Hex);

const canonical = `POST\n/api/v1/pix\n${idempotencyKey}\n${timestamp}\n${bodyHash}`;
const signature = CryptoJS.HmacSHA256(canonical, secret).toString(
  CryptoJS.enc.Hex,
);

pm.request.headers.upsert({ key: "Idempotency-Key", value: idempotencyKey });
pm.request.headers.upsert({ key: "X-Client-Id", value: clientId });
pm.request.headers.upsert({ key: "X-Timestamp", value: timestamp });
pm.request.headers.upsert({
  key: "X-Signature",
  value: `hmac-sha256=${signature}`,
});

{
  "code": "UNAUTHORIZED",
  "message": "Autenticacao invalida",
  "traceId": "abc123def456",
  "timestamp": "2026-04-26T14:30:01.234Z"
}