API Signing Proxy

About

The API Signing Proxy is a module that accepts HTTP requests without authorization headers and forwards them to the specified S1MPL API URL, adding an Authorization header containing a digital signature.

S1MPL APIs use the Authorization header for authentication in the following format:

Authorization: s1mpl signature <identity> <alg> <data>

• identity – user or service identity provided by the S1MPL team
• alg – signature algorithm; the supported algorithms depend on the API
• data – Base64-encoded byte array containing:
  • timestamp – 8 bytes representing the UTC time when the HTTP request is sent
  • request ID – 16-byte request UUID that is unique for each request
  • signature – the remaining bytes containing the digital signature of the preceding bytes; the signature length depends on the algorithm

Supported algorithms

• blake3
• ed25519
• es256
• hmac-sha-256

Requirements

Hardware Requirements

• RAM - 1 GB
• CPU - 2 vCPU core 2Ghz or higher
• Storage: 1 GB of free space

System Requirements:

• A container runtime, such as Docker, Podman, or Kubernetes
• Internet access

Launch steps

Generate a secret

For blake3

openssl rand -out secret.key 32

For ed25519

openssl genpkey -algorithm ed25519 -outform der -out secret.key
openssl pkey -inform der -in secret.key -pubout -outform der -out public.key

For es256

openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-256 -outform der -out secret.key
openssl pkey -inform der -in secret.key -pubout -outform der -out public.key

For hmac-sha-256

openssl rand -out secret.key 64

Obtain an Identity

Request an identity from the vendor and send the generated public.key file to the vendor.

For blake3 and hmac-sha-256, securely share the secret key with the vendor instead of a public key.

For this example, assume that the provided identity is my-identity.

Launch the Proxy

Run the Docker container and expose the proxy on port 8888:

Launch docker container with proxy listening on 8888 port:

docker run -d --rm --pull always -p 8888:8080 \
  -e S1MPL_PROXY__APIURL=https://ms.s1mpl.com \
  -e S1MPL_PROXY__IDENTITY=my-identity \
  -e S1MPL_PROXY__ALGORITHM=es256 \
  -e S1MPL_PROXY__SECRETFILEPATH=/secret.key \
  -v $(pwd)/secret.key:/secret.key:ro \
  registry.luxena.com/public/api-signing-proxy

For example, suppose the server running the proxy has the IP address 10.0.0.1. Every request sent to http://10.0.0.1:8888 will then be forwarded to https://ms.s1mpl.com with a digitally signed Authorization header added.