Authentication

{
  "access_token": "eyJhbGciOiJFUzI1NiIs...",
  "token_type": "DPoP",
  "expires_in": 28800
}

Authorization: DPoP <access_token>
DPoP: <proof JWT, fresh per request>

{
  "typ": "dpop+jwt",
  "alg": "ES256",
  "jwk": { "kty": "EC", "crv": "P-256", "x": "...", "y": "..." }
}

#!/usr/bin/env bash
set -euo pipefail

API=https://api.antonpayments.dev
CLIENT_ID="${ANTON_CLIENT_ID:?missing}"
CLIENT_SECRET="${ANTON_CLIENT_SECRET:?missing}"
PRIV_PEM="${ANTON_PRIVATE_KEY_PEM:?path to your PKCS#8 EC private key}"

b64url() { openssl base64 -A | tr '+/' '-_' | tr -d '='; }
sha256_b64url() { openssl dgst -sha256 -binary | b64url; }

# Build a DPoP proof. ath_b64 is empty for the token request.
build_proof() {
  local method="$1" url="$2" ath_b64="${3:-}"

  # Extract public key (x, y) from the PEM.
  local raw_hex x_hex y_hex
  raw_hex=$(openssl ec -in "$PRIV_PEM" -pubout -outform DER 2>/dev/null \
            | tail -c 65 | xxd -p -c 999)
  x_hex=${raw_hex:2:64}
  y_hex=${raw_hex:66:64}
  local x y
  x=$(echo "$x_hex" | xxd -r -p | b64url)
  y=$(echo "$y_hex" | xxd -r -p | b64url)

  local header claims
  header=$(printf '{"typ":"dpop+jwt","alg":"ES256","jwk":{"kty":"EC","crv":"P-256","x":"%s","y":"%s"}}' "$x" "$y" | b64url)
  if [ -n "$ath_b64" ]; then
    claims=$(printf '{"jti":"%s","htm":"%s","htu":"%s","iat":%d,"ath":"%s"}' \
             "$(uuidgen)" "$method" "$url" "$(date +%s)" "$ath_b64" | b64url)
  else
    claims=$(printf '{"jti":"%s","htm":"%s","htu":"%s","iat":%d}' \
             "$(uuidgen)" "$method" "$url" "$(date +%s)" | b64url)
  fi
  local signing_input="$header.$claims"
  local sig_der sig_p1363
  sig_der=$(printf '%s' "$signing_input" | openssl dgst -sha256 -sign "$PRIV_PEM" -binary)
  # Convert ASN.1 DER signature to IEEE P1363 (r || s, 64 bytes for P-256).
  sig_p1363=$(printf '%s' "$sig_der" | python3 -c "
import sys
from asn1crypto import core
data = sys.stdin.buffer.read()
seq = core.Sequence.load(data)
r = int(seq[0]).to_bytes(32, 'big')
s = int(seq[1]).to_bytes(32, 'big')
sys.stdout.buffer.write(r + s)
" | b64url)
  printf '%s.%s' "$signing_input" "$sig_p1363"
}

# 1. Mint a token.
TOKEN_PROOF=$(build_proof POST "$API/oauth/token")
TOKEN_RESP=$(curl -fsS -X POST "$API/oauth/token" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "DPoP: $TOKEN_PROOF" \
  -d "grant_type=client_credentials")
ACCESS_TOKEN=$(echo "$TOKEN_RESP" | jq -r .access_token)

# 2. Build a per-request proof (this one carries `ath`) and call /v1.
ATH=$(printf '%s' "$ACCESS_TOKEN" | sha256_b64url)
REQ_URL="$API/v1/beneficiaries"
REQ_PROOF=$(build_proof GET "$REQ_URL" "$ATH")

curl -fsS "$REQ_URL" \
  -H "Authorization: DPoP $ACCESS_TOKEN" \
  -H "DPoP: $REQ_PROOF"