openssl genrsa -out private_key.pem 2048

openssl rsa -in private_key.pem -pubout > public_key.pem

"@method": GET
"@authority": api.numeral.io
"@request-target": /v1/payment_orders
"@signature-params": ("@method" "@authority" "@request-target");alg="rsa-v1_5-sha256";keyid="your-public-key-identifier";created=1675688690

"@method": POST
"@authority": api.numeral.io
"@request-target": /v1/payment_orders
"content-digest": sha-256=:9AmU2hRsZnqEo2HiNTLacLN0fOs8YmDiuX4WYeYWvh0=:
"@signature-params": ("@method" "@authority" "@request-target" "content-digest");alg="rsa-v1_5-sha256";keyid="your-public-key-identifier";created=1675688690

package signature

import (
	"crypto"
	"crypto/rand"
	"crypto/rsa"
	"crypto/sha256"
	"crypto/x509"
	"encoding/base64"
	"encoding/pem"
	"fmt"
	"log"
	"net/http"
	"net/url"
	"sort"
	"strings"
)

func SignatureHeader(request http.Request, serializedBody []byte, keyID string, created int64, privateKey string) string {
	// Build the signature base.
	var optionalParam, optionalLine string
	if len(serializedBody) != 0 {
		optionalLine = fmt.Sprintf(`"content-digest": %s`, ContentDigestHeader(serializedBody)) + "\n"
		optionalParam += ` "content-digest"`
	}
	signatureBase := fmt.Sprintf(`"@method": %s
"@authority": %s
"@request-target": %s
%s"@signature-params": %s`,
		request.Method,
		request.Host,
		request.URL.RequestURI(),
		optionalLine,
		signatureParams(len(serializedBody) != 0, keyID, created),
	)

	// Sign the signature base.
	signature, err := sha256AndSignPKCS1v15(loadPrivateKey(privateKey), []byte(signatureBase))
	if err != nil {
		log.Fatal(err)
	}

	return fmt.Sprintf("sig1=:%s:", signature)
}

func SignatureInputHeader(hasDigest bool, keyID string, created int64) string {
	return fmt.Sprintf(`sig1=%s`, signatureParams(
		hasDigest,
		keyID,
		created,
	))
}

func ContentDigestHeader(serializedBody []byte) string {
	hash := sha256.Sum256(serializedBody)
	encodedHash := base64.StdEncoding.EncodeToString(hash[:])
	return fmt.Sprintf("sha-256=:%s:", encodedHash)
}

func signatureParams(hasDigest bool, keyID string, created int64) string {
	var optionalParam string
	if hasDigest {
		optionalParam += ` "content-digest"`
	}
	return fmt.Sprintf(`("@method" "@authority" "@request-target"%s);alg="rsa-v1_5-sha256";keyid="%s";created=%d`,
		optionalParam,
		keyID,
		created,
	)
}

func loadPrivateKey(pemString string) *rsa.PrivateKey {
	block, _ := pem.Decode([]byte(pemString))
	privateKey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
	if err != nil {
		log.Fatal(err)
	}
	return privateKey
}

// sha256AndSignPKCS1v15 hashes the message using SHA256,
// then signs it using RSASSA-PKCS1-V1_5-SIGN from RSA PKCS #1 v1.5.
// It returns the signature as a base64 string.
func sha256AndSignPKCS1v15(privateKey *rsa.PrivateKey, message []byte) (string, error) {
	hashed := sha256.Sum256(message)

	signature, err := rsa.SignPKCS1v15(
		rand.Reader,
		privateKey,
		crypto.SHA256,
		hashed[:],
	)
	if err != nil {
		return "", err
	}

	return base64.StdEncoding.EncodeToString(signature), nil
}

func ReorderQueryParameters(originalURL string) (string, error) {
	parsedURL, err := url.Parse(originalURL)
	if err != nil {
		return "", err
	}

	parsedQueryParams, err := url.ParseQuery(parsedURL.RawQuery)
	if err != nil {
		return "", err
	}

	// Sort the query parameters alphabetically by key name.
	keys := make([]string, 0, len(parsedQueryParams))
	for key := range parsedQueryParams {
		keys = append(keys, key)
	}
	sort.Strings(keys)

	// Construct the new query string.
	var sortedQueryParams []string
	for _, key := range keys {
		values := parsedQueryParams[key]
		for _, value := range values {
			sortedQueryParams = append(sortedQueryParams, fmt.Sprintf("%s=%s", key, value))
		}
	}

	// Create a new URL with the sorted query parameters
	parsedURL.RawQuery = strings.Join(sortedQueryParams, "&")
	return parsedURL.String(), nil
}

import base64
import collections
import urllib.parse

# From pycryptodome library.
from Crypto.Signature import PKCS1_v1_5
from Crypto.Hash import SHA256
from Crypto.PublicKey import RSA


def signature_header(
    method: str,
    host: str,
    request_uri: str,
    serialized_body: bytes,
    key_id: str,
    created: int,
    private_key: str,
) -> str:
    # Build the signature base.
    optional_param, optional_line = "", ""
    if serialized_body:
        optional_line = '"content-digest": {}'.format(content_digest_header(serialized_body)) + "\n"
        optional_param += ' "content-digest"'

    signature_base = """"@method": {}
"@authority": {}
"@request-target": {}
{}"@signature-params": {}""".format(
        method,
        host,
        request_uri,
        optional_line,
        _signature_params(serialized_body is not None, key_id, created),
    )

    signature = _sha256_and_sign_pkcs1v15(private_key, signature_base.encode())
    return "sig1=:{}:".format(signature)


def signature_input_header(has_digest: bool, key_id: str, created: int) -> str:
    return "sig1={}".format(_signature_params(has_digest, key_id, created))


def content_digest_header(serialized_body: bytes) -> str:
    hashed = SHA256.new()
    hashed.update(serialized_body)
    return "sha-256=:{}:".format(base64.b64encode(hashed.digest()).decode())


def _signature_params(has_digest: bool, key_id: str, created: int) -> str:
    optional_param = ""
    if has_digest:
        optional_param += ' "content-digest"'
    return '("@method" "@authority" "@request-target"{});alg="rsa-v1_5-sha256";keyid="{}";created={}'.format(
        optional_param,
        key_id,
        created,
    )


def _sha256_and_sign_pkcs1v15(private_key: str, message: bytes) -> str:
    hashed = SHA256.new()
    hashed.update(message)
    key = RSA.import_key(private_key)
    signer = PKCS1_v1_5.new(key)
    signature = signer.sign(hashed)
    return base64.b64encode(signature).decode()

def reorder_query_parameters(url: str) -> str:
    parsed_url = urllib.parse.urlparse(url)
    parsed_query_params = urllib.parse.parse_qs(parsed_url.query)
    sorted_params = collections.OrderedDict(sorted(parsed_query_params.items()))
    new_query_string = urllib.parse.urlencode(sorted_params, doseq=True)
    return urllib.parse.urlunparse((
        parsed_url.scheme,
        parsed_url.netloc,
        parsed_url.path,
        parsed_url.params,
        new_query_string,
        parsed_url.fragment,
    ))

<?php

/**
 * Performs a signed HTTP request.
 *
 * @param string $method The HTTP method (e.g., "POST").
 * @param string $url The URL to which the request is made.
 * @param string $serializedBody The serialized request body.
 * @param string $apiKey The API key for authentication.
 * @param string $publicKeyID The public key ID used for signing the request.
 * @param int $timestamp The current timestamp.
 */
function doSignedRequest($method, $url, $serializedBody, $apiKey, $publicKeyID, $timestamp) {
    // Reorder query parameters alphabetically for consistent signing
    $url = reorderQueryParameters($url);

    // Initialize cURL session
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $serializedBody);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    
    // Enable verbose output for debugging purposes
    $verbose = fopen('php://temp', 'w+');
    curl_setopt($ch, CURLOPT_VERBOSE, true);
    curl_setopt($ch, CURLOPT_STDERR, $verbose);
    
    // Generate signature input and signature headers
    $signatureInputHeader = signatureInputHeader($serializedBody, $publicKeyID, $timestamp);
    $signatureHeader = signatureHeader($method, $url, $serializedBody, $publicKeyID, $timestamp);

    // Prepare HTTP headers for the request
    $headers = [
        "Content-Type: application/json",
        "Numeral-Api-Version: 2022-01-01",
        "X-Api-Key: $apiKey",
        "Signature-Input: $signatureInputHeader",
        "Signature: $signatureHeader",
        "User-Agent: Numeral", // Custom user agent
    ];

    // Include Content-Digest header if request body is not empty
    if (!empty($serializedBody)) {
        $contentDigestHeader = contentDigestHeader($serializedBody);
        $headers[] = "Content-Digest: $contentDigestHeader";
    }

    // Set HTTP headers for the cURL request
    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

    // Execute the cURL session
    $response = curl_exec($ch);
    if ($response === false) {
        // Output cURL error and verbose log for debugging
        fseek($verbose, 0); // Seek to the start of verbose output
        $verboseLog = stream_get_contents($verbose);
        echo "cURL Error: " . curl_error($ch) . "\nVerbose Output:\n" . $verboseLog;
    } else {
        // Output the response
        echo $response;
    }

    // Close resources
    fclose($verbose);
    curl_close($ch);
}

/**
 * Reorders query parameters alphabetically.
 *
 * @param string $url The URL with query parameters to reorder.
 * @return string The URL with reordered query parameters.
 */
function reorderQueryParameters($url) {
    $parsedUrl = parse_url($url);
    if (!isset($parsedUrl['query'])) return $url;

    parse_str($parsedUrl['query'], $queryParams);
    ksort($queryParams);
    $queryString = http_build_query($queryParams);

    return $parsedUrl['scheme'] . '://' . $parsedUrl['host'] . (isset($parsedUrl['path']) ? $parsedUrl['path'] : '') . '?' . $queryString;
}

/**
 * Generates the Signature header value.
 *
 * @param string $method The HTTP method.
 * @param string $url The request URL.
 * @param string $serializedBody The request body.
 * @param string $publicKeyID The public key ID.
 * @param int $timestamp The timestamp.
 * @return string The Signature header value.
 */
function signatureHeader($method, $url, $serializedBody, $publicKeyID, $timestamp) {
    $parsedUrl = parse_url($url);
    $requestUri = $parsedUrl['path'] . (isset($parsedUrl['query']) ? '?' . $parsedUrl['query'] : '');

    // Construct the signature base string
    $methodPart = '"@method": ' . strtoupper($method) . "\n";
    $authorityPart = '"@authority": ' . $parsedUrl['host'] . "\n";
    $requestTargetPart = '"@request-target": ' . $requestUri . "\n";
    $contentDigestPart = !empty($serializedBody) ? '"content-digest": ' . contentDigestHeader($serializedBody) . "\n" : '';
    $signatureParamsPart = '"@signature-params": ' . signatureParams(!empty($serializedBody), $publicKeyID, $timestamp);

    // Concatenate parts to form the base string
    $signatureBase = $methodPart .  $authorityPart .  $requestTargetPart . $contentDigestPart  . $signatureParamsPart;

    // Sign the base string and encode in base64
    return 'sig1=:' . sha256AndSignPKCS1v15($signatureBase) . ':';
}

/**
 * Generates the Signature-Input header value.
 *
 * @param string $serializedBody The request body.
 * @param string $publicKeyID The public key ID.
 * @param int $timestamp The timestamp.
 * @return string The Signature-Input header value.
 */
function signatureInputHeader($serializedBody, $publicKeyID, $timestamp) {
    return 'sig1=' . signatureParams($serializedBody, $publicKeyID, $timestamp);
}

/**
 * Constructs the signature parameters string.
 *
 * @param string $serializedBody The request body.
 * @param string $publicKeyID The public key ID.
 * @param int $timestamp The timestamp.
 * @return string The formatted signature parameters.
 */
function signatureParams($serializedBody, $publicKeyID, $timestamp) {
    $optionalParam = !empty($serializedBody) ? ' "content-digest"' : '';
    return sprintf('("@method" "@authority" "@request-target"%s);alg="rsa-v1_5-sha256";keyid="%s";created=%d',
        $optionalParam, $publicKeyID, $timestamp);
}

/**
 * Generates the Content-Digest header value.
 *
 * @param string $serializedBody The request body.
 * @return string The Content-Digest header value.
 */
function contentDigestHeader($serializedBody) {
    $hash = hash('sha256', $serializedBody, true);
    return 'sha-256=:' . base64_encode($hash) . ':';
}

/**
 * Signs a message with RSA-SHA256 and encodes the signature in base64.
 *
 * @param string $message The message to sign.
 * @return string The base64-encoded signature.
 */
function sha256AndSignPKCS1v15($message) {
    // Load the private key
    $privateKey = openssl_get_privatekey(file_get_contents("./private_key.pem"));
    if (!$privateKey) {
        die("Failed to load private key.");
    }
    
    // Sign the message
    openssl_sign($message, $signature, $privateKey, OPENSSL_ALGO_SHA256);
    
    // Return the base64-encoded signature
    return base64_encode($signature);
}

package main

import (
	"bytes"
	"io"
	"log"
	"net/http"
	"time"

	"signatures/signature"
)

func main() {
	doSignedRequest(
		"POST",
		"https://api.numeral.io/v1/payment_orders",
		[]byte(`{
            "type": "sepa",
            "direction": "credit",
            "amount": 315,
            "currency": "EUR",
            "connected_account_id": "replace this",
            "receiving_account": {
                "account_number": "replace this",
                "bank_code": "replace this",
                "holder_name": "replace this",
                "holder_address": {
                    "country": "FR"
                }
            },
            "reference": "example"
        }`),
		"replace this by your API key",
		"replace this by your public key identifier",
		"replace this by your private key in PEM format",
		time.Now().UTC().Unix(),
	)
}

func doSignedRequest(
	method string,
	url string,
	serializedBody []byte,
	apiKey string,
	publicKeyID string,
	privateKey string,
	timestamp int64,
) {
	url, err := signature.ReorderQueryParameters(url)
	if err != nil {
		log.Fatal(err)
	}

	// Create the request.
	client := &http.Client{}
	request, err := http.NewRequest(method, url, bytes.NewReader(serializedBody))
	if err != nil {
		log.Fatal(err)
	}

	// Set headers.
	request.Header.Set("Content-Type", "application/json")
	request.Header.Set("Numeral-Api-Version", "2022-01-01")
	request.Header.Set("X-Api-Key", apiKey)
	signatureInputHeader := signature.SignatureInputHeader(
		len(serializedBody) != 0,
		publicKeyID,
		timestamp,
	)
	request.Header.Set("Signature-Input", signatureInputHeader)
	signatureHeader := signature.SignatureHeader(
		*request,
		serializedBody,
		publicKeyID,
		timestamp,
		privateKey,
	)

	request.Header.Set("Signature", signatureHeader)
	if len(serializedBody) != 0 {
		contentDigestHeader := signature.ContentDigestHeader(serializedBody)
		request.Header.Set("Content-Digest", contentDigestHeader)
	}

	response, err := client.Do(request)
	if err != nil {
		log.Fatal(err)
	}

	defer response.Body.Close()
	_, err = io.ReadAll(response.Body)
	if err != nil {
		log.Fatal(err)
	}
}

import datetime
import json

import requests
import urllib.parse

import signature  # The small library provided by Numeral.


def do_signed_request(
    method: str,
    url: str,
    serialized_body: bytes | None,
    api_key: str,
    public_key_id: str,
    private_key: str,
    timestamp: int,
) -> requests.Response:
    url = signature.reorder_query_parameters(url)

    signature_input_header = signature.signature_input_header(
        has_digest=serialized_body is not None,
        key_id=public_key_id,
        created=timestamp,
    )

    parsed_url = urllib.parse.urlparse(url)
    signature_header = signature.signature_header(
        method=method,
        host=parsed_url.hostname,
        request_uri=url.split(parsed_url.hostname, 1)[1],
        serialized_body=serialized_body,
        key_id=public_key_id,
        created=timestamp,
        private_key=private_key,
    )

    headers = {
        "Content-Type": "application/json",
        "X-Api-Key": api_key,
        "Signature": signature_header,
        "Signature-Input": signature_input_header,
    }

    if serialized_body is not None:
        headers["Content-Digest"] = signature.content_digest_header(serialized_body)

    return requests.request(
        method=method,
        url=url,
        headers=headers,
        data=serialized_body,
    )


def _utc_now_timestamp() -> int:
    now = datetime.datetime.now(datetime.timezone.utc)
    utc_time = now.replace(tzinfo=datetime.timezone.utc)
    return int(utc_time.timestamp())


if __name__ == '__main__':
    do_signed_request(
        method="POST",
        url="https://api.numeral.io/v1/payment_orders",
        serialized_body=json.dumps({
            "type": "sepa",
            "direction": "credit",
            "amount": 315,
            "currency": "EUR",
            "connected_account_id": "replace this",
            "receiving_account": {
                "account_number": "replace this",
                "bank_code": "replace this",
                "holder_name": "replace this",
                "holder_address": {
                    "country": "FR"
                }
            },
            "reference": "example"
        }).encode(),
        api_key="replace this by your API key",
        public_key_id="replace this by your public key identifier",
        private_key="replace this by your private key in PEM format",
        timestamp=_utc_now_timestamp(),
    )

<?php

require_once 'signature.php'; // Adjust the path as necessary

// Your JSON payload or other data
$rawJson = <<<JSON
{
    "type": "sepa",
    "direction": "credit",
    "amount": 315,
    "currency": "EUR",
    "connected_account_id": "replace this",
    "receiving_account": {
        "account_number": "replace this",
        "bank_code": "replace this",
        "holder_name": "replace this",
        "holder_address": { "country": "FR" }
    },
    "reference": "numeral PHP"
}
JSON;

// Example usage of the doSignedRequest function
doSignedRequest(
    "POST",
    "https://api.numeral.io/v1/payment_orders",
    $rawJson, // Pass your JSON payload here
    "put_your_api_key_here", // API key
    "put_your_public_key_id_here", // Public key ID
    time() // Current timestamp
);

{
  "error": "invalid_request",
  "message": "invalid Signature header"
}

{
  "error": "invalid_request",
  "message": "invalid Signature-Input header"
}

{
  "error": "invalid_request",
  "message": "unable to verify signature parameters"
}

{
  "error": "unauthorized",
  "message": "invalid signature"
}