> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bango.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Signing HTTP messages

> signing messages for authorized access

<Note>
  This page currently applies only to the **Bango Resale for resellers**
</Note>

Bango requires [HTTP message signing](https://tools.ietf.org/id/draft-cavage-http-signatures-12.html) for Bango Resale calls. This stops unauthorized access to the Bango Platform, and ensures the data integrity of all your calls to Bango Resale.

Bango requires the reseller to provide a public key which will be used to verify all signed API requests made to Bango. The key must be RSA-SHA256 algorithm and be 1024 bit length. The public key must be provided as either a pem file or RSA key xml.

Bango makes use of the following sections from the [signing HTTP messages IETF documentation](https://tools.ietf.org/id/draft-cavage-http-signatures-12.html): 2.1.1, 2.1.2, 2.1.3, 2.1.6 and 2.4.

Below is what the headers must look like for a signed request to the Bango Resale:

* **Created**: 1402174295
* **Signature**: keyId=RSA-SHA256V1, headers=Created, signature=Base64(RSA-SHA256(Signature String))

Constructing the request headers:

**Created**

The value must be a Unix timestamp integer value. Full details can be found [here](https://tools.ietf.org/id/draft-cavage-http-signatures-12.html#rfc.section.2.1.4). The time difference between the timestamp and the current UTC time should be within 120 seconds.

**Signature**

A breakdown of the signature can be found in the below table. There must be a space after each comma in the signature. See the example in the section above. Full details can be found [here](https://tools.ietf.org/id/draft-cavage-http-signatures-12.html#rfc.section.2.4).

| Detail | Value | Description |
| - | - | - |
| keyId | RSA-SHA256V1 | A constant string which refers to the RSA-SHA256 algorithm used to sign the request. |
| headers | Created | Refers to the header that is used as part of the signature string. The minimum expected by Bango is created however you can include more by using a semicolon to seperate them. E.g. headers=Created;EntitlementId |
| signature | Base64(RSA-SHA256(Signature String)) | Refers to the Base64 encoded string of the RSA-SHA256 algorithm applied over the Signature String. |
| Signature String | See example below. | This refers to the actual content that would be encoded. This contains the headers and the payload of the request. The payload must not contain carriage return, horizontal tab and new lines. |

Example Private Key

```text theme={null}
21wEnTU+mcD2w0Lfo1Gv4rtcSWsQJQTNa6gio05AOkV/Er9w3Y13Ddo5wGtjJ19402S71HUeN0vbKILLJdRSES5MHSdJPSVrOqdrll/vLXxDxWs/U0UT1c8u6k/Ogx9hTtZxYwoeYqdhDblof3E75d9n2F0Zvf6iTb4cI7j6fMs=AQAB

/aULPE6jd5IkwtWXmReyMUhmI/nfwfkQSyl7tsg2PKdpcxk4mpPZUdEQhHQLvE84w2DhTyYkPHCtq/mMKE3MHw==

3WV46X9Arg2l9cxb67KVlNVXyCqc/w+LWt/tbhLJvV2xCF/0rWKPsBJ9MC6cquaqNPxWWEav8RAVbmmGrJt51Q==8TuZFgBMpBoQcGUoS2goB4st6aVq1FcG0hVgHhUI0GMAfYFNPmbDV3cY2IBt8Oj/uYJYhyhlaj5YTqmGTYbATQ==FIoVbZQgrAUYIHWVEYi/187zFd7eMct/Yi7kGBImJStMATrluDAspGkStCWe4zwDDmdam1XzfKnBUzz3AYxrAQ==QPU3Tmt8nznSgYZ+5jUo9E0SfjiTu435ihANiHqqjasaUNvOHKumqzuBZ8NRtkUhS6dsOEb8A2ODvy7KswUxyA==cgoRoAUpSVfHMdYXW9nA3dfX75dIamZnwPtFHq80ttagbIe4ToYYCcyUz5NElhiNQSESgS5uCgNWqWXt5PnPu4XmCXx6utco1UVH8HGLahzbAnSy6Cj3iUIQ7Gj+9gQ7PkC434HTtHazmxVgIR5l56ZjoQ8yGNCPZnsdYEmhJWk=
```

Constructing the signature string

The below example signature produced below was created using the private key provided above with the payload set out below:

```text theme={null}
BASE64(SHA256(created + payload from request))

Example:
signature = BASE64 (SHA-256(
    1576595412
    {
        "customerIdentifier": "my-user-123456789",
        "merchantAccountKey": "BANGO",
        "productKey": "BangoMusic",
        "notificationUrl": "https://example.com/entitlement/notification"
    }
))

//The combination of the created header value and payload from the request would create the following signature.
YQi9uNAkqXFMigidHijmM9Z8ahVq8B0LM2rHXJruIocR8ujk0sonSLq6LuMMEWRfnpUmmsqzuulpNiQoeRfLFxVKoamTeKPGisJpdw6fREPJeHmz2nGoA7/vQ2YFKDUpUtByE8ZUjdrbHTf/0kPvyPIuuRT6uJaFEBwX+XJRC+8=
```

<Note>
  If the Bango Resale responds with **HTTP 401 UNAUTHORIZED**, this may mean your request has failed due to a message signing issue. Below is a list of the http status code 401 response messages:

  * **"No valid key found."** A valid public key could not be found for the reseller. Either a public key isn't set or the public key set has expired.
  * **"Signature or header content is missing."** A header defined as provided in the signature is missing from the request.
  * **"Signature is invalid."** The signature value in the request to Bango doesn't match the signature Bango has generated with the public key.
</Note>