API 인증하기

카카오스타일 Open API는 Access Key를 통해 요청자를 구분합니다. 이 키는 파트너센터에서 발급합니다. 키는 쇼핑몰 별로 발급됩니다.

인증된 곳에서 보낸 메시지인지 확인하기 위해 HMAC을 이용합니다. Access Key와 같이 발급된 Secret Key를 이용해 signature를 생성해 Authorization 헤더에 담아 보내야 합니다. 그 형식은 다음과 같습니다.

CEA algorithm=HmacSHA256, access-key=<Access Key>, signed-date=<날짜>, signature=<signature>

권한 목록

• GET-ORDER: 주문조회
• UPDATE-ORDER: 주문갱신
• GET-PRODUCT: 상품조회
• UPDATE-PRODUCT: 상품갱신
• GET-REVIEW: 리뷰조회

예제

다음은 헤더를 얻기 위한 각 언어별 예제입니다.

Java

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.NoSuchAlgorithmException;
import java.security.InvalidKeyException;
import java.util.Formatter;

public class Zigzag {
  private static String toHexString(byte[] bytes) {
    Formatter formatter = new Formatter();
    for (byte b : bytes) {
      formatter.format("%02x", b);
    }
    return formatter.toString();
  }

  public static String createAuthorization(String accessKey, String secretKey, String query) {
    try {
      long signedDate = System.currentTimeMillis();

      query = query.replaceAll("\\s+", " ");
      String message = Long.toString(signedDate) + "." + query;

      Mac hasher = Mac.getInstance("HmacSHA1");
      hasher.init(new SecretKeySpec(secretKey.getBytes(), "HmacSHA1"));
      byte[] hash = hasher.doFinal(message.getBytes());
      String signature = toHexString(hash);

      return "CEA algorithm=HmacSHA256, access-key=" + accessKey + ", signed-date=" + Long.toString(signedDate) + ", signature=" + signature;
    } catch (NoSuchAlgorithmException e) {
      return "";
    } catch (InvalidKeyException e) {
      return "";
    }
  }

  public static void main(String[] args) {
    String authorization = createAuthorization("access-key", "secret-key", "graphql-query");
  }
}

PHP

<?php
function createAuthorization($accessKey, $secretKey, $query) {
  list($usec, $sec) = explode(" ", microtime());
  $signedDate = $sec.(int)($usec*1000);
    $query = preg_replace('#\s+#' , " " , $query);
  $message = "{$signedDate}.{$query}";
  $signature = hash_hmac('sha1', $message, $secretKey);
  return "CEA algorithm=HmacSHA256, access-key=".$accessKey.", signed-date=".$signedDate.", signature=".$signature;
}

$authorization = createAuthorization('access-key', 'secret-key', 'graphql-query');
?>

Python2

import hashlib
import hmac
import time
import re

def create_authorization(access_key, secret_key, query):
  signed_date = str(int(time.time()*1000))
  query = re.sub(r'\s+', ' ', query)
  message = signed_date + '.' + query
  signature = hmac.new(secret_key, message, hashlib.sha1).hexdigest()
  return 'CEA algorithm=HmacSHA256, access-key=' + access_key + ', signed-date=' + signed_date + ', signature=' + signature

authorization = create_authorization('access-key', 'secret-key', 'graphql-query')

Python3

import hashlib
import hmac
import time
import re

def create_authorization(access_key, secret_key, query):
  signed_date = str(int(time.time()*1000))
  query = re.sub(r'\s+', ' ', query)
  message = bytes(signed_date + '.' + query, 'utf-8')
  signature = hmac.new(bytes(secret_key, 'utf-8'), message, hashlib.sha1).hexdigest()
  return 'CEA algorithm=HmacSHA256, access-key=' + access_key + ', signed-date=' + signed_date + ', signature=' + signature

authorization = create_authorization('access-key', 'secret-key', 'graphql-query')

Node.js

const crypto = require('crypto');

function createAuthorization(accessKey, secretKey, query) {
  const signedDate = Date.now();
  query = query.replace(/\s+/g, ' ');
  const message = signedDate + '.' + query;
  const hash = crypto.createHmac('sha1', secretKey).update(message);
  const signature = hash.digest('hex');
  return (
    'CEA algorithm=HmacSHA256, access-key=' + accessKey + ', signed-date=' + signedDate + ', signature=' + signature
  );
}

const authorization = createAuthorization('access-key', 'secret-key', 'graphql-query');