DIAMOND Calculating Dynamic "X-Signature" for Mobile APIs

[TheMekanic]

[ Hidden Content! ]

Apps for UberEats and DoorDash often use a Hash-based Message Authentication Code (HMAC) to sign requests. You must replicate this to avoid "403 Forbidden" errors.
LoliCode Implementation:

Code:

BLOCK:Script
string timestamp = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds().ToString();

string secret = "base64_encoded_app_secret_here";

string payload = timestamp + data.USER;


// Create HMAC-SHA256 Signature

var key = Encoding.UTF8.GetBytes(secret);

using (var hmac = new System.Security.Cryptography.HMACSHA256(key)) {

    var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(payload));

    data.Variables.Set(new StringVariable(BitConverter.ToString(hash).Replace("-", "").ToLower(), "SIG"));

}ENDBLOCK

Header: Add

Code:

X-Signature: <SIG>

to your next HTTP block.