Authentication

const crypto = require('crypto');

const API_KEY = process.env.MODULUS_API_KEY;
const API_SECRET = process.env.MODULUS_API_SECRET;
// The gateway prefix belongs in the URL you call, but NOT in the path you sign.
const BASE_URL = 'https://api.sbx.moduluslabs.io/v1/terminal-gateway';

/**
 * Generate authentication headers for HTTP API requests
 * @param {string} method - HTTP method (GET, POST)
 * @param {string} path - Endpoint path to sign, without the /v1/terminal-gateway
 *                        prefix (e.g., /v1/terminals)
 * @param {object|null} body - Request body (null for GET requests)
 * @returns {object} Headers object with authentication
 */
function generateAuthHeaders(method, path, body = null) {
  const timestamp = new Date().toISOString();

  // SHA256 hash of body (empty string for GET)
  const bodyString = body ? JSON.stringify(body) : '';
  const bodyHash = crypto
    .createHash('sha256')
    .update(bodyString)
    .digest('hex');

  // Construct string to sign
  const stringToSign = `${method}\n${path}\n${timestamp}\n${bodyHash}`;

  // Compute HMAC-SHA256 signature
  const signature = crypto
    .createHmac('sha256', API_SECRET)
    .update(stringToSign)
    .digest('base64');

  return {
    'Content-Type': 'application/json',
    'x-api-key': API_KEY,
    'x-timestamp': timestamp,
    'x-signature': signature
  };
}

// Example: GET request
async function getTerminals() {
  const path = '/v1/terminals'; // signed path, no /v1/terminal-gateway prefix
  const headers = generateAuthHeaders('GET', path);

  const response = await fetch(`${BASE_URL}${path}`, {
    method: 'GET',
    headers
  });

  return response.json();
}

// Example: POST request
async function createPayment(terminalId, paymentData) {
  const path = `/v1/terminals/${terminalId}/payments`;
  const headers = generateAuthHeaders('POST', path, paymentData);

  const response = await fetch(`${BASE_URL}${path}`, {
    method: 'POST',
    headers,
    body: JSON.stringify(paymentData)
  });

  return response.json();
}

import hashlib
import hmac
import base64
import json
import os
from datetime import datetime, timezone
import requests

API_KEY = os.getenv('MODULUS_API_KEY')
API_SECRET = os.getenv('MODULUS_API_SECRET')
# The gateway prefix belongs in the URL you call, but NOT in the path you sign.
BASE_URL = 'https://api.sbx.moduluslabs.io/v1/terminal-gateway'


def generate_auth_headers(method: str, path: str, body_string: str = '') -> dict:
    """
    Generate authentication headers for HTTP API requests.

    Args:
        method: HTTP method (GET, POST)
        path: Endpoint path to sign, without the /v1/terminal-gateway
              prefix (e.g., /v1/terminals)
        body_string: The exact JSON string you will send ('' for GET requests)

    Returns:
        Headers dict with authentication
    """
    timestamp = datetime.now(timezone.utc).isoformat(timespec='milliseconds').replace('+00:00', 'Z')

    # SHA256 hash of the exact body string (empty string for GET)
    body_hash = hashlib.sha256(body_string.encode()).hexdigest()

    # Construct string to sign
    string_to_sign = f'{method}\n{path}\n{timestamp}\n{body_hash}'

    # Compute HMAC-SHA256 signature
    signature = base64.b64encode(
        hmac.new(
            API_SECRET.encode(),
            string_to_sign.encode(),
            hashlib.sha256
        ).digest()
    ).decode()

    return {
        'Content-Type': 'application/json',
        'x-api-key': API_KEY,
        'x-timestamp': timestamp,
        'x-signature': signature
    }


# Example: GET request
def get_terminals():
    path = '/v1/terminals'  # signed path, no /v1/terminal-gateway prefix
    headers = generate_auth_headers('GET', path)

    response = requests.get(f'{BASE_URL}{path}', headers=headers)
    return response.json()


# Example: POST request
def create_payment(terminal_id: str, payment_data: dict):
    path = f'/v1/terminals/{terminal_id}/payments'

    # Serialize once, sign that string, and send that same string
    body_string = json.dumps(payment_data)
    headers = generate_auth_headers('POST', path, body_string)

    response = requests.post(
        f'{BASE_URL}{path}',
        headers=headers,
        data=body_string
    )
    return response.json()

const WebSocket = require('ws');

const API_KEY = process.env.MODULUS_API_KEY;
const WS_ENDPOINT = 'wss://api.sbx.moduluslabs.io/v1/terminal-gateway/ws';

// Option 1: Header-based authentication (recommended)
function connectWithHeaders() {
  const ws = new WebSocket(WS_ENDPOINT, {
    headers: {
      'x-api-key': API_KEY
    }
  });

  ws.on('open', () => {
    console.log('Connected with header authentication');
  });

  ws.on('error', (error) => {
    console.error('Connection error:', error.message);
  });

  return ws;
}

// Option 2: Query parameter authentication
function connectWithQueryParam() {
  const ws = new WebSocket(`${WS_ENDPOINT}?x-api-key=${API_KEY}`);

  ws.on('open', () => {
    console.log('Connected with query parameter authentication');
  });

  return ws;
}

import asyncio
import websockets
import os

API_KEY = os.getenv('MODULUS_API_KEY')
WS_ENDPOINT = 'wss://api.sbx.moduluslabs.io/v1/terminal-gateway/ws'


# Option 1: Header-based authentication (recommended)
async def connect_with_headers():
    headers = {
        'x-api-key': API_KEY
    }

    async with websockets.connect(WS_ENDPOINT, extra_headers=headers) as ws:
        print('Connected with header authentication')
        # Handle messages...
        async for message in ws:
            print(f'Received: {message}')


# Option 2: Query parameter authentication
async def connect_with_query_param():
    url = f'{WS_ENDPOINT}?x-api-key={API_KEY}'

    async with websockets.connect(url) as ws:
        print('Connected with query parameter authentication')
        # Handle messages...
        async for message in ws:
            print(f'Received: {message}')