I am trying to connect third party from Salesforce. I am using Hmac sha256 algorithm for authentication and getting 403 error: Forbidden request, invalid auth credential

my code is as below: can anyone please guide me how to solve this issue. Thanks in advance.

          XmlStreamWriter w = new XmlStreamWriter();
          w.writeStartElement(null, 'LoanReference', null);
          w.writeStartElement(null, 'BrokerConsultantName', null);

        DateTime dateTimeNow = dateTime.now();
        String unixTime = ''+dateTimeNow.getTime()/1000;        
        String xmlOutput = w.getXmlString();
        String privKey = 'test123456789';
        String publicKey = 'test987654321';
        String responseBody;        

        Blob blobSign = Crypto.generateDigest('SHA256', Blob.valueOf(privKey + xmlOutput.length() + unixTime));
        String HMACKey = EncodingUtil.base64Encode(blobSign);

        String endpoint='https://api-test.test.com/test/test/new/';

        HttpRequest request = new HttpRequest();

        request.setHeader('Content-Type', 'application/xml');
        request.setHeader('API-HMAC',HMACKey );

        Http http = new Http();
        HttpResponse response = http.send(request); 
        responseBody = response.getBody(); 
        System.debug('@@@XML Output'+xmlOutput);     
        System.debug('@@@Response:'+ Response);
        System.debug('@@@Response Body:'+ ResponseBody);
        System.debug('@@@time: '+unixTime);
        System.debug('@@@HMACKey: '+ HMACKey);
        System.debug('@@@BlobSign: ' + blobsign);

This line looks very suspicious:

Blob blobSign = Crypto.generateDigest('SHA256', Blob.valueOf(privKey + xmlOutput.length() + unixTime));

I'm guessing it should be something like:

Blob blobSign = Crypto.generateDigest('SHA256', Blob.valueOf(privKey + xmlOutput + unixTime));
  • Hi Metadaddy, Thank you for your reply. I tried removing the lenght, but the same 403 error. – User sfdc Mar 1 '16 at 23:42
  • One more observation - shouldn't you be using Crypto. generateMac if the API wants HMAC? So I'm guessing Blob blobSign = crypto.generateMac('HmacSHA256', Blob.valueOf(xmlOutput), Blob.valueOf(privKey)); – metadaddy Mar 2 '16 at 6:13
  • Hi Metadaddy, I tried with crypto.generateMac, but it is giving error - "Method does not exist or incorrect signature: Crypto.generateMac(String, Blob)". – User sfdc Mar 2 '16 at 6:46
  • The Url is correct, but the issue still exists. working on it. – User sfdc Mar 4 '16 at 4:20
  • 1
    Hi Metadaddy, Finally got success message with right XML data format. – User sfdc Mar 10 '16 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.