인증 · 요청 서명

// Node.js 18 이상(fetch 내장)
const crypto = require('node:crypto');

const API_BASE = 'https://api.billingplus.co.kr/api/v1';
const API_KEY = process.env.BILLINGPLUS_API_KEY;        // bpk_live_ 로 시작
const API_SECRET = process.env.BILLINGPLUS_API_SECRET;  // bos_ 로 시작 — 서버에만 둡니다

function sign(method, pathWithQuery, timestamp, nonce, body, secret) {
  const bodyHash = crypto.createHash('sha256').update(body).digest('hex'); // 본문이 없으면 '' 의 해시
  const message = [method.toUpperCase(), pathWithQuery, timestamp, nonce, bodyHash].join('\n');
  return crypto.createHmac('sha256', secret).update(message, 'utf8').digest('hex');
}

async function call(method, path, payload, idempotencyKey) {
  method = method.toUpperCase();
  const url = new URL(API_BASE + path);                 // path 예: '/ping', '/customers?limit=5'
  const body = payload === undefined ? Buffer.alloc(0) : Buffer.from(JSON.stringify(payload), 'utf8');
  const timestamp = String(Math.floor(Date.now() / 1000));   // 밀리초가 아니라 초
  const nonce = crypto.randomBytes(16).toString('hex');       // 요청마다 새 32자

  const headers = {
    'X-BillingPlus-Key': API_KEY,
    'X-BillingPlus-Timestamp': timestamp,
    'X-BillingPlus-Nonce': nonce,
    'X-BillingPlus-Signature': sign(method, url.pathname + url.search, timestamp, nonce, body, API_SECRET),
  };
  if (body.length) headers['Content-Type'] = 'application/json; charset=utf-8';
  if (method === 'POST') {
    if (!idempotencyKey) throw new Error('POST 에는 Idempotency-Key 가 필요합니다.');
    headers['Idempotency-Key'] = idempotencyKey;
  }

  const res = await fetch(url, { method, headers, body: body.length ? body : undefined });
  return { status: res.status, requestId: res.headers.get('x-request-id'), body: await res.json() };
}

call('GET', '/ping').then((r) => console.log(r));

<?php
// PHP 7.4 이상, curl 확장
const API_BASE = 'https://api.billingplus.co.kr/api/v1';

function bp_sign(string $method, string $pathWithQuery, string $timestamp, string $nonce,
                 string $body, string $secret): string {
    $bodyHash = hash('sha256', $body);           // 본문이 없으면 '' 의 해시
    $message = implode("\n", [strtoupper($method), $pathWithQuery, $timestamp, $nonce, $bodyHash]);
    return hash_hmac('sha256', $message, $secret);
}

function bp_call(string $method, string $path, ?array $payload = null, ?string $idempotencyKey = null): array {
    $method = strtoupper($method);
    $url = API_BASE . $path;                     // $path 예: '/ping', '/customers?limit=5'
    $parts = parse_url($url);
    $pathWithQuery = $parts['path'] . (isset($parts['query']) ? '?' . $parts['query'] : '');

    $body = $payload === null ? '' : json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
    $timestamp = (string) time();                // 초
    $nonce = bin2hex(random_bytes(16));          // 요청마다 새 32자

    $headers = [
        'X-BillingPlus-Key: ' . getenv('BILLINGPLUS_API_KEY'),
        'X-BillingPlus-Timestamp: ' . $timestamp,
        'X-BillingPlus-Nonce: ' . $nonce,
        'X-BillingPlus-Signature: ' . bp_sign($method, $pathWithQuery, $timestamp, $nonce, $body,
                                              getenv('BILLINGPLUS_API_SECRET')),
    ];
    if ($body !== '') {
        $headers[] = 'Content-Type: application/json; charset=utf-8';
    }
    if ($method === 'POST') {
        if (!$idempotencyKey) {
            throw new InvalidArgumentException('POST 에는 Idempotency-Key 가 필요합니다.');
        }
        $headers[] = 'Idempotency-Key: ' . $idempotencyKey;
    }

    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_HTTPHEADER => $headers,
        CURLOPT_POSTFIELDS => $body,             // 서명한 문자열 그대로
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CONNECTTIMEOUT => 5,
        CURLOPT_TIMEOUT => 60,
    ]);
    $response = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    curl_close($ch);
    return [$status, json_decode((string) $response, true)];
}

print_r(bp_call('GET', '/ping'));

// Java 17 이상
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.SecureRandom;
import java.time.Duration;
import java.util.HexFormat;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class BillingPlusClient {
    static final String API_BASE = "https://api.billingplus.co.kr/api/v1";
    static final String API_KEY = System.getenv("BILLINGPLUS_API_KEY");       // bpk_live_ 로 시작
    static final String API_SECRET = System.getenv("BILLINGPLUS_API_SECRET"); // bos_ 로 시작
    static final HttpClient HTTP = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(5)).build();
    static final SecureRandom RANDOM = new SecureRandom();

    static String sign(String method, String pathWithQuery, String timestamp, String nonce,
                       byte[] body, String secret) throws Exception {
        String bodyHash = HexFormat.of().formatHex(
            MessageDigest.getInstance("SHA-256").digest(body)); // 본문이 없으면 new byte[0]
        String message = String.join("\n", method.toUpperCase(), pathWithQuery, timestamp, nonce, bodyHash);
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        return HexFormat.of().formatHex(mac.doFinal(message.getBytes(StandardCharsets.UTF_8)));
    }

    /** path 예: "/ping", "/customers?limit=5" — 본문이 없으면 json 은 null */
    static HttpResponse<String> call(String method, String path, String json, String idempotencyKey)
            throws Exception {
        method = method.toUpperCase();
        URI uri = URI.create(API_BASE + path);
        String pathWithQuery = uri.getRawPath() + (uri.getRawQuery() != null ? "?" + uri.getRawQuery() : "");
        byte[] body = json == null ? new byte[0] : json.getBytes(StandardCharsets.UTF_8);
        String timestamp = String.valueOf(System.currentTimeMillis() / 1000); // 초
        byte[] random = new byte[16];
        RANDOM.nextBytes(random);
        String nonce = HexFormat.of().formatHex(random);                     // 요청마다 새 32자

        HttpRequest.Builder request = HttpRequest.newBuilder(uri)
            .timeout(Duration.ofSeconds(60))
            .header("X-BillingPlus-Key", API_KEY)
            .header("X-BillingPlus-Timestamp", timestamp)
            .header("X-BillingPlus-Nonce", nonce)
            .header("X-BillingPlus-Signature", sign(method, pathWithQuery, timestamp, nonce, body, API_SECRET))
            .method(method, body.length == 0 ? HttpRequest.BodyPublishers.noBody()
                                             : HttpRequest.BodyPublishers.ofByteArray(body));
        if (body.length > 0) {
            request.header("Content-Type", "application/json; charset=utf-8");
        }
        if (method.equals("POST")) {
            if (idempotencyKey == null || idempotencyKey.isEmpty()) {
                throw new IllegalArgumentException("POST 에는 Idempotency-Key 가 필요합니다.");
            }
            request.header("Idempotency-Key", idempotencyKey);
        }
        return HTTP.send(request.build(), HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
    }

    public static void main(String[] args) throws Exception {
        HttpResponse<String> response = call("GET", "/ping", null, null);
        System.out.println(response.statusCode() + " " + response.body());
    }
}