Documentation
¶
Overview ¶
Package cdp holds what every Coinbase Developer Platform (CDP) client shares: the bearer JWT that authenticates one REST request, and the API key that signs it.
CDP authenticates each request with a short-lived JWT signed by the caller's Ed25519 API key, bound to that one request by its `uri` claim ("METHOD host/path"). See https://docs.cdp.coinbase.com/api-reference/v2/authentication. The same token is minted for two audiences: ThirdParty.GetJwt hands one to the app for a request the app makes itself (thirdparty/), and the server-to-server clients under this package (customers/, and later the bank payout leg) sign their own requests with it.
Index ¶
Constants ¶
const JWTLifetime = 120 * time.Second
JWTLifetime is how long a token from NewJWT is valid, from its issue time. CDP accepts at most two minutes.
Variables ¶
This section is empty.
Functions ¶
func NewJWT ¶
func NewJWT(method, host, path, keyID string, privateKey ed25519.PrivateKey) (string, error)
NewJWT returns a CDP bearer token for one request, signed with the API key keyID / privateKey. Its `uri` claim is "METHOD host/path", built exactly as given: host is the bare host (with a port only if the request URL has one) and path is the URL path with no query string, which CDP leaves out of the claim. The token is valid from now for JWTLifetime and carries a random nonce, so two tokens for the same request differ.
NewJWT does not validate method, host or path: it signs whatever request it is given, so which requests are signed is its caller's to decide. ThirdParty.GetJwt, whose caller is an app, signs only the requests on its allowlist (thirdparty/coinbase.go). A private key of the wrong length is refused rather than signed with (ed25519.Sign would panic).
Types ¶
type APIKey ¶
type APIKey struct {
ID string
PrivateKey ed25519.PrivateKey
}
APIKey is a CDP secret API key: its ID (the JWT's `kid` and `sub`) and its Ed25519 private key.
func ParseAPIKeyJSON ¶
ParseAPIKeyJSON parses the key file the CDP portal downloads for an Ed25519 secret API key: a JSON object with `id` and `privateKey`, the latter the standard base64 encoding of the 64-byte private key (seed then public key). Errors never quote the file, since it is a secret.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package customers is a client for Coinbase Developer Platform's Customers API (https://docs.cdp.coinbase.com/customers-kyc/overview), through which Coinbase verifies the identity of a Flipcash user (KYC) so they can later cash out to a bank account.
|
Package customers is a client for Coinbase Developer Platform's Customers API (https://docs.cdp.coinbase.com/customers-kyc/overview), through which Coinbase verifies the identity of a Flipcash user (KYC) so they can later cash out to a bank account. |
|
customerstest
Package customerstest is an in-process fake of Coinbase's Customers API for tests: an httptest server speaking the same REST API as Coinbase, so tests drive the real customers.Client against it rather than a mock.
|
Package customerstest is an in-process fake of Coinbase's Customers API for tests: an httptest server speaking the same REST API as Coinbase, so tests drive the real customers.Client against it rather than a mock. |