Référence API

curl -X POST https://api.zykay.com/v1/exchange \
  -H "Content-Type: application/json" \
  -H "X-Partner-ID: pk_live_xxx" \
  -H "X-Partner-Timestamp: 1700000000" \
  -H "X-Partner-Nonce: 550e8400-e29b-41d4-a716-446655440000" \
  -H "X-Partner-Signature: IiqKqzxLThjE4anzR2UGycy5JrJKSjjD2m3R81RxsW8" \
  -d '{"grant_code":"g_abc123..."}'

{
  "pass_token": "p_xyz789...",
  "expires_in": 14400,
  "age_over_18": true,
  "scopes": ["isAdult"],
  "attributes": {
    "age_over_18": true
  }
}

curl -X POST https://api.zykay.com/v1/introspect \
  -H "Content-Type: application/json" \
  -H "X-Partner-ID: pk_live_xxx" \
  -H "X-Partner-Timestamp: 1700000000" \
  -H "X-Partner-Nonce: 550e8400-e29b-41d4-a716-446655440000" \
  -H "X-Partner-Signature: ..." \
  -d '{"pass_token":"p_xyz789..."}'

{
  "active": true,
  "scope": "multi_scope_verification",
  "attributes": {
    "age_over_18": true,
    "is_french": true
  },
  "scopes_verified": ["isAdult", "isFrench"]
}

const crypto = require('crypto');
 
function base64url(buffer) {
  return buffer.toString('base64')
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=+$/, '');
}
 
// 1. Hash du body (SHA256)
const bodyHash = base64url(
  crypto.createHash('sha256').update(JSON.stringify(body)).digest()
);
 
// 2. Chaîne canonique
const canonical = `${bodyHash}.${timestamp}.${partnerId}.${nonce}`;
 
// 3. IMPORTANT: Décoder le secret base64
const secretBytes = Buffer.from(partnerSecret, 'base64');
 
// 4. Signature HMAC
const signature = base64url(
  crypto.createHmac('sha256', secretBytes).update(canonical).digest()
);