ING API with python

3.1. Digesting and signing

You need to calculate the SHA256 of some parts. That can be done with:

from Crypto.Hash import SHA256

# to digest 'text'
digest = SHA256.new()
digest.update(text.encode())

From that we can create a function that does it and can also sign the digest with:

sign_key = "certificates/example_client_signing.key" # Adapt path

def encode_sha256(text, sign=False):
    """ digest a text with SHA256 """

    digest = SHA256.new()
    digest.update(text.encode())

    if sign:
        # Get the signing key
        with open(sign_key, "r") as file:
            data = file.read()

        private_key = RSA.importKey(data)
        signer = PKCS1_v1_5.new(private_key)
        out = signer.sign(digest)

    else:
        out = digest.digest()

    return b64encode(out).decode()

And finally we need to encode it as a base64 string with:

from base64 import b64encode

b64encode(out).decode()

3.2. Parameters

Now let’s create the basic parameters:

import uuid
from datetime import datetime

mdate = datetime.utcnow().strftime("%a, %d %b %Y %H:%M:%S GMT")
digest = encode_sha256(body) # Without signing
req_id = str(uuid.uuid4())

And the headers:

headers = {
    "Date": mdate,
    "Digest": f"SHA-256={digest}",
    "X-ING-ReqID": req_id,
    "Content-Type": "application/x-www-form-urlencoded",
    "Accept": "application/json",
}

3.3. Getting the signature

In this step you need to encode with SHA256 the composition of:

• endpoint
• date
• body digest
• req_id

After that you need to append some information. All of that can be done with:

def get_signature(method, endpoint, mdate, digest, req_id):

    text = [
        f"(request-target): {method.lower()} {endpoint}",
        f"date: {mdate}",
        f"digest: SHA-256={digest}",
        f"x-ing-reqid: {req_id}",
    ]

    signature_digest = encode_sha256("\n".join(text), True)

    signature = [
        f'keyId="{client_id}"',
        'algorithm="rsa-sha256"',
        'headers="(request-target) date digest x-ing-reqid"',
        f'signature="{signature_digest}"',
    ]

    return ",".join(signature)

3.4. Doing the request

Now we need to append the authorization as a header:

signature = get_signature(method, endpoint, mdate, digest, req_id)
if token:
    headers.update({"Authorization": f"Bearer {token}", "Signature": signature})
else:
    headers.update({"Authorization": f"Signature {signature}"})

And finally we can do the request:

tls_cert="certificates/example_client_tls.cer",
tls_key="certificates/example_client_tls.key",

result = requests.request(
    method.upper(),
    self.host + endpoint,
    headers=headers,
    data=body,
    cert=(tls_cert, tls_key),
)

3.5. Getting the token

This can be done with the code explained and using those params:

• endpoint: /oauth2/token
• method: POST
• body: grant_type=client_credentials

4.1. Generating your certificates

You need to generate:

• ing_http.key
• ing_http.key
• ing_tls.crt
• ing_tls.crt

You can generate the first 2 with:

# 1. Generate an RSA private key. The password of the private key can be entered during execution of the command, so it doesn't end up in the history of your shell.
openssl genrsa -out ing_http.key -passout stdin 2048
# 2. Generate the X.509 Certificate Signing Request
openssl req -sha256 -new -key ing_http.key -out ing_http.csr
# 3. Sign the X.509 certificate with your own private key
openssl x509 -req -sha256 -days 365 -in ing_http.csr -signkey ing_http.key -out ing_http.crt

Then need to repeat the 3 steps but replacing ing_http by ing_tls.

4.2. Getting a token with your API

You need to follow the same as before but changing some params:

• host: https://api.ing.com
• client_id: You can get that from the web
• sign_key: certificates/ing_http.key
• tls_cert: certificates/ing_tls.crt
• tls_key: certificates/ing_tls.key

4.3. Doing a hello world

Once you have the open you can suscribe to Showcase API. You will need to wait until your request is approved.

Once it is approved you can query the only endpoint to check that everything is working:

• method: GET
• endpoint: /greetings/single