Authentication

: "${BIZZLINK_API_TOKEN:?BIZZLINK_API_TOKEN not set}"
: "${BIZZLINK_HMAC_SECRET:?BIZZLINK_HMAC_SECRET not set}"

TIMESTAMP=$(date +%s)
METHOD="POST"
# Append ?key=value&... here if your endpoint takes query params
PATH_AND_QUERY="/bizzlink/api/v1/document/send/ubl21"
BODY='{"ublXml":"<Invoice>...</Invoice>"}'

BODY_HASH=$(printf '%s' "${BODY}" | openssl dgst -sha256 -hex | sed 's/^.* //')
SIGNATURE=$(printf '%s' "${TIMESTAMP}.${METHOD}.${PATH_AND_QUERY}.${BODY_HASH}" | \
  openssl dgst -sha256 -hmac "${BIZZLINK_HMAC_SECRET}" | sed 's/^.* //')

curl -X ${METHOD} "https://gateway.vigasoft.lu${PATH_AND_QUERY}" \
  -H "Authorization: Bearer ${BIZZLINK_API_TOKEN}" \
  -H "X-Bizzlink-Signature: t=${TIMESTAMP},v1=${SIGNATURE}" \
  -H "Content-Type: application/json" \
  -d "${BODY}"

// Raw signing — for production use the SDK instead:
//   Maven: lu.vigasoft:bizzlink-sdk-java:0.3.1
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;
import java.nio.charset.StandardCharsets;
import java.util.HexFormat;

String apiToken   = System.getenv("BIZZLINK_API_TOKEN");
String hmacSecret = System.getenv("BIZZLINK_HMAC_SECRET");

String timestamp  = String.valueOf(System.currentTimeMillis() / 1000);
String method     = "POST";
// Append ?key=value&... here if your endpoint takes query params
String pathAndQuery = "/bizzlink/api/v1/document/send/ubl21";

// Java 15+ text block — no backslash-escape hell
String body = """
        {"ublXml":"<Invoice>...</Invoice>"}""";
String bodyHash = HexFormat.of().formatHex(
    MessageDigest.getInstance("SHA-256").digest(body.getBytes(StandardCharsets.UTF_8)));
String payload = timestamp + "." + method + "." + pathAndQuery + "." + bodyHash;

Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(hmacSecret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
String signature = HexFormat.of().formatHex(
    mac.doFinal(payload.getBytes(StandardCharsets.UTF_8)));

// Set headers on your HTTP request:
//   Authorization: Bearer <apiToken>
//   X-Bizzlink-Signature: t=<timestamp>,v1=<signature>
//   Content-Type: application/json
// Body must be the EXACT same bytes used to compute bodyHash.

import hashlib
import hmac
import json
import os
import time
import requests

API_TOKEN   = os.environ["BIZZLINK_API_TOKEN"]
HMAC_SECRET = os.environ["BIZZLINK_HMAC_SECRET"]

timestamp = str(int(time.time()))
method    = "POST"
# Append ?key=value&... here if your endpoint takes query params
path_and_query = "/bizzlink/api/v1/document/send/ubl21"

# Serialize once — same bytes are hashed and sent
body = json.dumps({"ublXml": "<Invoice>...</Invoice>"}, separators=(",", ":")).encode()

body_hash = hashlib.sha256(body).hexdigest()
payload   = f"{timestamp}.{method}.{path_and_query}.{body_hash}".encode()
signature = hmac.new(HMAC_SECRET.encode(), payload, hashlib.sha256).hexdigest()

response = requests.post(
    f"https://gateway.vigasoft.lu{path_and_query}",
    headers={
        "Authorization":         f"Bearer {API_TOKEN}",
        "X-Bizzlink-Signature":  f"t={timestamp},v1={signature}",
        "Content-Type":          "application/json",
    },
    data=body,
)

// Node.js 18+ (built-in fetch + crypto)
import crypto from 'node:crypto';

const API_TOKEN   = process.env.BIZZLINK_API_TOKEN;
const HMAC_SECRET = process.env.BIZZLINK_HMAC_SECRET;

const timestamp = Math.floor(Date.now() / 1000).toString();
const method    = 'POST';
// Append ?key=value&... here if your endpoint takes query params
const pathAndQuery = '/bizzlink/api/v1/document/send/ubl21';

// Serialize once — same bytes are hashed and sent
const body = JSON.stringify({ ublXml: '<Invoice>...</Invoice>' });

const bodyHash  = crypto.createHash('sha256').update(body).digest('hex');
const payload   = `${timestamp}.${method}.${pathAndQuery}.${bodyHash}`;
const signature = crypto.createHmac('sha256', HMAC_SECRET)
  .update(payload).digest('hex');

const response = await fetch(`https://gateway.vigasoft.lu${pathAndQuery}`, {
  method,
  headers: {
    'Authorization':         `Bearer ${API_TOKEN}`,
    'X-Bizzlink-Signature':  `t=${timestamp},v1=${signature}`,
    'Content-Type':          'application/json',
  },
  body,
});

<?php
// composer require guzzlehttp/guzzle
use GuzzleHttp\Client;

$apiToken   = getenv('BIZZLINK_API_TOKEN');
$hmacSecret = getenv('BIZZLINK_HMAC_SECRET');

$timestamp = time();
$method    = 'POST';
// Append ?key=value&... here if your endpoint takes query params
$pathAndQuery = '/bizzlink/api/v1/document/send/ubl21';

// Serialize once — same bytes are hashed and sent
$body = json_encode(['ublXml' => '<Invoice>...</Invoice>'], JSON_UNESCAPED_SLASHES);

$bodyHash  = hash('sha256', $body);
$payload   = "{$timestamp}.{$method}.{$pathAndQuery}.{$bodyHash}";
$signature = hash_hmac('sha256', $payload, $hmacSecret);

$client   = new Client();
$response = $client->post('https://gateway.vigasoft.lu' . $pathAndQuery, [
    'headers' => [
        'Authorization'        => "Bearer {$apiToken}",
        'X-Bizzlink-Signature' => "t={$timestamp},v1={$signature}",
        'Content-Type'         => 'application/json',
    ],
    'body' => $body,
]);