eHub SMS REST API

# Python signing example
import hmac, hashlib, time, json, requests

api_key = 'sk_your_api_key'
secret  = 'your_api_secret'
method  = 'POST'
path    = '/api/v1/sms/send'
body    = json.dumps({'to': '255755000000', 'message': 'Hello!', 'sender_id': 'uuid-here'})

timestamp = str(int(time.time()))
payload   = f"{timestamp}\n{method}\n{path}\n{body}"
signature = hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()

response = requests.post(
    'https://sms.ehub.co.tz/api/v1/sms/send',
    headers={
        'Authorization': f'Bearer {api_key}',
        'X-Timestamp':   timestamp,
        'X-Signature':   signature,
        'Content-Type':  'application/json',
    },
    data=body
)

// Go signing example
package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "net/http"
    "strings"
    "strconv"
    "time"
)

func sign(secret, method, path, body string) (string, string) {
    ts := strconv.FormatInt(time.Now().Unix(), 10)
    payload := ts + "\n" + method + "\n" + path + "\n" + body
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(payload))
    return ts, hex.EncodeToString(mac.Sum(nil))
}

func main() {
    apiKey := "sk_your_api_key"
    secret := "your_api_secret"
    body   := `{"to":"255755000000","message":"Hello!","sender_id":"uuid-here"}`

    ts, sig := sign(secret, "POST", "/api/v1/sms/send", body)

    req, _ := http.NewRequest("POST",
        "https://sms.ehub.co.tz/api/v1/sms/send",
        strings.NewReader(body))

    req.Header.Set("Authorization", "Bearer "+apiKey)
    req.Header.Set("X-Timestamp", ts)
    req.Header.Set("X-Signature", sig)
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    fmt.Println(resp.Status, err)
}

// Java signing example
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.net.URI;
import java.net.http.*;
import java.time.Instant;

public class EhubSmsClient {

    static String sign(String secret, String method, String path, String body) throws Exception {
        String ts      = String.valueOf(Instant.now().getEpochSecond());
        String payload = ts + "\n" + method + "\n" + path + "\n" + body;

        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret.getBytes(), "HmacSHA256"));
        byte[] raw = mac.doFinal(payload.getBytes());

        StringBuilder hex = new StringBuilder();
        for (byte b : raw) hex.append(String.format("%02x", b));
        return ts + ":" + hex;   // returns "timestamp:signature"
    }

    public static void main(String[] args) throws Exception {
        String apiKey = "sk_your_api_key";
        String secret = "your_api_secret";
        String body   = "{\"to\":\"255755000000\",\"message\":\"Hello!\",\"sender_id\":\"uuid-here\"}";

        String[] parts = sign(secret, "POST", "/api/v1/sms/send", body).split(":", 2);
        String ts  = parts[0];
        String sig = parts[1];

        HttpRequest req = HttpRequest.newBuilder()
            .uri(URI.create("https://sms.ehub.co.tz/api/v1/sms/send"))
            .header("Authorization", "Bearer " + apiKey)
            .header("X-Timestamp",   ts)
            .header("X-Signature",   sig)
            .header("Content-Type",  "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> resp =
            HttpClient.newHttpClient().send(req, HttpResponse.BodyHandlers.ofString());
        System.out.println(resp.body());
    }
}

// Node.js signing example
const crypto = require('crypto');

const API_KEY  = 'sk_your_api_key';
const SECRET   = 'your_api_secret';
const BASE_URL = 'https://sms.ehub.co.tz';

async function sendSms(to, message, senderId) {
  const path = '/api/v1/sms/send';
  const body = JSON.stringify({ to, message, sender_id: senderId });
  const timestamp = Math.floor(Date.now() / 1000);

  const payload = [timestamp, 'POST', path, body].join('\n');
  const signature = crypto
    .createHmac('sha256', SECRET)
    .update(payload)
    .digest('hex');

  const res = await fetch(BASE_URL + path, {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${API_KEY}`,
      'X-Timestamp':   String(timestamp),
      'X-Signature':   signature,
      'Content-Type':  'application/json',
    },
    body,
  });

  const data = await res.json();
  console.log(data);
}

sendSms('255755000000', 'Hello!', 'uuid-here');

# cURL signing example (bash)
API_KEY="sk_your_api_key"
SECRET="your_api_secret"
BODY='{"to":"255755000000","message":"Hello!","sender_id":"uuid-here"}'
TS=$(date +%s)
PAYLOAD="${TS}
POST
/api/v1/sms/send
${BODY}"
SIG=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

curl -s -X POST https://sms.ehub.co.tz/api/v1/sms/send \
  -H "Authorization: Bearer $API_KEY" \
  -H "X-Timestamp: $TS" \
  -H "X-Signature: $SIG" \
  -H "Content-Type: application/json" \
  -d "$BODY"

import hmac, hashlib

expected = hmac.new(
    your_webhook_secret.encode(), raw_body, hashlib.sha256
).hexdigest()

sig = request.headers.get('X-eHub-Signature', '')
if not hmac.compare_digest(expected, sig):
    abort(401)

const crypto = require('crypto');

const expected = crypto
  .createHmac('sha256', yourWebhookSecret)
  .update(rawBody)            // the raw request body
  .digest('hex');

const sig = req.get('X-eHub-Signature') || '';
if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig))) {
  return res.sendStatus(401);
}

body, _ := io.ReadAll(r.Body)

mac := hmac.New(sha256.New, []byte(yourWebhookSecret))
mac.Write(body)
expected := hex.EncodeToString(mac.Sum(nil))

if !hmac.Equal([]byte(expected), []byte(r.Header.Get("X-eHub-Signature"))) {
    w.WriteHeader(http.StatusUnauthorized)
    return
}

Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
String expected = HexFormat.of().formatHex(
    mac.doFinal(rawBody.getBytes(StandardCharsets.UTF_8)));

String sig = request.getHeader("X-eHub-Signature");
if (!MessageDigest.isEqual(expected.getBytes(), sig.getBytes())) {
    response.setStatus(401);
    return;
}

require 'openssl'

expected = OpenSSL::HMAC.hexdigest('SHA256', your_webhook_secret, raw_body)

sig = request.env['HTTP_X_EHUB_SIGNATURE'].to_s
unless Rack::Utils.secure_compare(expected, sig)
  halt 401
end