Authorization signatures

import canonicalize from 'canonicalize'; // Support JSON canonicalization
import crypto from 'crypto'; // Support P-256 signing

// Replace this with your private key from the Dashboard
const PRIVY_AUTHORIZATION_KEY = 'wallet-auth:insert-your-private-key-here';
// ...

function getAuthorizationSignature({url, body}: {url: string; body: object}) {
  const payload = {
    version: 1,
    method: 'POST',
    url,
    body,
    headers: {
      'privy-app-id': 'insert-your-app-id'
      // If your request includes an idempotency key, include that header here as well
    }
  };

  // JSON-canonicalize the payload and convert it to a buffer
  const serializedPayload = canonicalize(payload) as string;
  const serializedPayloadBuffer = Buffer.from(serializedPayload);

  // Replace this with your app's authorization key. We remove the 'wallet-auth:' prefix
  // from the key before using it to sign requests
  const privateKeyAsString = PRIVY_AUTHORIZATION_KEY.replace('wallet-auth:', '');

  // Convert your private key to PEM format, and instantiate a node crypto KeyObject for it
  const privateKeyAsPem = `-----BEGIN PRIVATE KEY-----\n${privateKeyAsString}\n-----END PRIVATE KEY-----`;
  const privateKey = crypto.createPrivateKey({
    key: privateKeyAsPem,
    format: 'pem'
  });

  // Sign the payload buffer with your private key and serialize the signature to a base64 string
  const signatureBuffer = crypto.sign('sha256', serializedPayloadBuffer, privateKey);
  const signature = signatureBuffer.toString('base64');
  return signature;
}

const authorizationSignature = getAuthorizationSignature({
  // Replace with your desired path
  url: 'https://api.privy.io/v1/wallets/<wallet_id>/rpc',
  // Replace with your desired body
  body: {
    method: 'personal_sign',
    params: {
      message: 'Hello world',
      // ...
    },
  }
});

import json
import base64
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import ec, utils

# Replace this with your private key from the Dashboard

PRIVY_AUTHORIZATION_KEY = "wallet-auth:your-authorization-private-key"

def canonicalize(obj):
    """
    Simple JSON canonicalization function.
    Sorts dictionary keys and ensures consistent formatting.
    """

    return json.dumps(obj, sort_keys=True, separators=(",", ":"))

def get_authorization_signature(url, body):
    """
    Generate authorization signature for Privy API requests using ECDSA and hashlib.
    """
    # Construct the payload
    payload = {
        "version": 1,
        "method": "POST",
        "url": url,
        "body": body,
        "headers": {"privy-app-id": "insert-your-app-id"},
    }

    # Serialize the payload to JSON
    serialized_payload = canonicalize(payload)

    # Create ECDSA P-256 signing key from private key
    private_key_string = PRIVY_AUTHORIZATION_KEY.replace("wallet-auth:", "")
    private_key_pem = (
        f"-----BEGIN PRIVATE KEY-----\n{private_key_string}\n-----END PRIVATE KEY-----"
    )

    # Load the private key from PEM format
    private_key = serialization.load_pem_private_key(
        private_key_pem.encode("utf-8"), password=None
    )

    # Sign the message using ECDSA with SHA-256
    signature = private_key.sign(
        serialized_payload.encode("utf-8"), ec.ECDSA(hashes.SHA256())
    )

    # Convert the signature to base64 for easy transmission
    return base64.b64encode(signature).decode("utf-8")

authorization_signature = get_authorization_signature(
    url="https://api.privy.io/v1/wallets",
    body={
        "chain_type": "ethereum",
    },
)

import (
  "crypto/ecdsa"
  "crypto/elliptic"
  "crypto/rand"
  "crypto/x509"
  "encoding/base64"
  "encoding/json"
  "fmt"
  "hash/fnv"
  "strings"
  "crypto/sha256"
)

// SignPayload signs the canonicalized JSON payload using ECDSA (P-256 + SHA-256).
//
// privyAuthorizationKey - A string containing your authorization key with the 'wallet-auth:' prefix included.
// payload - JSON payload to sign, serialized to a string
//
// Returns the base64-encoded DER signature or an error.
func SignPayload(privyAuthorizationKey string, payload string) (string, error) {
  privateKey, err := parsePrivateKeyFromAuthorizationKey(privyAuthorizationKey)
  if err != nil {
    return "", fmt.Errorf("failed to parse private key: %w", err)
  }

  // Hash the payload using SHA-256
  hash := sha256.Sum256([]byte(payload))

  // Sign the hash
  signature, err := ecdsa.SignASN1(rand.Reader, privateKey, hash[:])
  if err != nil {
    return "", fmt.Errorf("failed to sign payload: %w", err)
  }

  // Base64 encode the signature
  signatureB64 := base64.StdEncoding.EncodeToString(signature)
  return signatureB64, nil
}

// We parse the ecdsa key from the authorization key here
func parsePrivateKeyFromAuthorizationKey(privyAuthorizationKey string) (*ecdsa.PrivateKey, error) {
  pkcs8B64 := strings.TrimPrefix(privyAuthorizationKey, "wallet-auth:")
  pkcs8Bytes, err := base64.StdEncoding.DecodeString(pkcs8B64)
  if err != nil {
    return nil, err
  }

  // This handles PKCS#8 parsing automatically
  key, err := x509.ParsePKCS8PrivateKey(pkcs8Bytes)
  if err != nil {
 	return nil, err
  }

  // Type assert to ECDSA private key
  ecdsaKey, ok := key.(*ecdsa.PrivateKey)
  if !ok {
 	return nil, fmt.Errorf("key provided is not an ECDSA private key")
  }

  return ecdsaKey, nil
}

// Utility function to verify the signature (for testing purposes)
func VerifySignature(publicKey *ecdsa.PublicKey, payload, signatureB64 string) (bool, error) {
  // Decode the base64 signature
  signature, err := base64.StdEncoding.DecodeString(signatureB64)
  if err != nil {
    return false, fmt.Errorf("failed to decode signature: %w", err)
  }
  // Hash the payload
  hash := sha256.Sum256([]byte(payload))

  // Verify the signature
  valid := ecdsa.VerifyASN1(publicKey, hash[:], signature)
  return valid, nil
}

import { useAuthorizationSignature } from '@privy-io/react-auth';

const { generateAuthorizationSignature } = useAuthorizationSignature();

// Build the request body for the wallet API.
const walletRequest = {
  version: 1,
  url: 'https://api.privy.io/v1/wallets/{wallet_id}/rpc',
  method: 'POST',
  headers: {
    'privy-app-id': '{privy_app_id}',
  },
  body: {
    method: 'personal_sign',
    params: {
      message: "Hello from Privy!",
      encoding: "utf-8"
    }
  },
} as const;

// Sign a wallet API request using the user's authorization key.
const authorizationSignature = await generateAuthorizationSignature(walletRequest)

// Set the authorization signature as a header on the request.
const response = await fetch(walletRequest.url, {
  method: walletRequest.method,
  headers: {
    ...walletRequest.headers,
    'Authorization': `Bearer ${accessToken}`,
    'privy-authorization-signature': authorizationSignature,
  },
  body: JSON.stringify(walletRequest.body),
});