Skip to main content

Authentication test

1. Introduction​

In this section we will explain how the request should work so that it can be accepted by our system. First, you must put the API Key provided by the QI DTVM team in the API-CLIENT-KEY header. Then you must create an AUTHORIZATION header signing with the integrating partner's Private Key;

Below we will teach step by step using Python to exemplify the AUTHORIZATION creation process.

2. Import libraries​

In this Python example we are using 5 libraries to perform the authentication process.

from datetime import datetime
import json
from jose import jwt
from hashlib import md5
import requests

3. Insert the private key and integration key​

Encryption data
api_key = "\<API KEY PROVIDED BY QI\>"

client_private_key = '''-----BEGIN EC PRIVATE KEY-----
MIHbAgEBBEH7OuewosJfz4zKF+Gm0ogJxhb8G6LSMDVQQbFYz335mHCx9/Pr6Yk+
yYwsVozeXhlry3/vnUn1zCasU+4O+yseZ6AHBgUrgQQAI6GBiQOBhgAEAa46fN/2
8vI64shRhu9erMA6JLl3zHFX8gFHQrbb0g4IDfjXCKMCILiwdtL8QecstsgepTa7
yo1pTXOVNDbmLX2TAK38xb2Gv6OC+PA+5drF2wWajWbVLpR2R7mYEzr5HNIAJYHb
5C1jvM2ItK2R22HAbYfH25nsvGhkCGbrRNWQVF9g
-----END EC PRIVATE KEY-----'''

4. Define variables​

Define the method, endpoint and content variables specific to each request (in this example, we will use the "POST" method for the "/authentication_test" endpoint)

Request data
base_url = "https://api.securities.qidtvm.com.br"
today_str = datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%S")
method = "POST"
endpoint = "/authentication_test"
body = {"name": "QI Tech"}

5. Build Base Signature Dictionary​

Base dictionary

dict_to_sign = {"timestamp": today_str, "method": method, "uri": endpoint}

5.1. If necessary, add the content​

For requests that have a body, you must add the md5 of the bytes of that content. Since all requests in our system are through JSON, you can use the following:

Base dictionary
body_bytes = json.dumps(body).encode()

md5_instance = md5()
md5_instance.update(body_bytes)
md5_body = md5_instance.hexdigest()

dict_to_sign["payload_md5"] = md5_body

6. Perform header encryption​

Perform encryption using JWT library (in this code example, we use jsonwebtoken as jwt in javascript)

jwt_headers = {"alg": "ES512", "typ": "JWT"}
encoded_header_token = jwt.encode(
    claims=dict_to_sign,
    key=client_private_key,
    algorithm="ES512",
    headers=jwt_headers,
)

7. Building the final header​

headers = {"API-CLIENT-KEY": api_key, "AUTHORIZATION": encoded_header_token}
Defining final url
url = f"{base_url}{endpoint}"

Making request​

resp = requests.post(url=url, headers=headers, json=body)
print(resp.json())