Authentication

# pip install requests
import base64
import hashlib
import hmac
import os
import secrets
import time

import requests

# The secret is shown once, when the key is created. Keep it out of source
# control. Read it from the environment or a secret manager.
KEY_ID = os.environ["VANTA_KEY_ID"]
SECRET = os.environ["VANTA_SECRET"]
BASE_URL = "https://app.vantatrading.io"

def signed_headers(method: str, path: str, body: str = "") -> dict:
    """Build the four auth headers for one request.

    `path` must be the request target exactly as it is sent: the pathname plus
    the query string, if any. Signing a different string than you request is
    the most common cause of a 401.
    """
    timestamp = str(int(time.time() * 1000))
    nonce = secrets.token_hex(16)
    canonical = "\n".join(
        [
            "v1",
            method.upper(),
            path,
            timestamp,
            nonce,
            hashlib.sha256(body.encode("utf-8")).hexdigest(),
        ]
    )
    signature = base64.b64encode(
        hmac.new(
            SECRET.encode("utf-8"), canonical.encode("utf-8"), hashlib.sha256
        ).digest()
    ).decode("ascii")
    return {
        "X-Vanta-Key-Id": KEY_ID,
        "X-Vanta-Timestamp": timestamp,
        "X-Vanta-Nonce": nonce,
        "X-Vanta-Signature": f"v1={signature}",
    }

// Node 18 or newer. No dependencies: `fetch` and `node:crypto` are built in.
import { createHash, createHmac, randomBytes } from "node:crypto";

// The secret is shown once, when the key is created. Keep it out of source
// control. Read it from the environment or a secret manager.
const KEY_ID = process.env.VANTA_KEY_ID;
const SECRET = process.env.VANTA_SECRET;
const BASE_URL = "https://app.vantatrading.io";

/**
 * Build the four auth headers for one request. `path` must be the request
 * target exactly as it is sent: pathname plus query string, if any.
 */
function signedHeaders(method, path, body = "") {
  const timestamp = String(Date.now());
  const nonce = randomBytes(16).toString("hex");
  const canonical = [
    "v1",
    method.toUpperCase(),
    path,
    timestamp,
    nonce,
    createHash("sha256").update(body, "utf8").digest("hex"),
  ].join("\n");
  const signature = createHmac("sha256", SECRET)
    .update(canonical, "utf8")
    .digest("base64");

  return {
    "X-Vanta-Key-Id": KEY_ID,
    "X-Vanta-Timestamp": timestamp,
    "X-Vanta-Nonce": nonce,
    "X-Vanta-Signature": `v1=${signature}`,
  };
}