如何使用PHP中的私钥签署有效负载？

Question

I am trying to utilize the GoodRx API using PHP.

Here is my code:

 $hash = hash_hmac('sha256', $query_string, MY_SECRET_KEY);
 $encoded = base64_encode($hash);
 $private_key = str_replace('+', '_', $encoded);
 $private_key = str_replace('/', '_', $encoded);
 //$private_key = urlencode($private_key);
 $query_string .= '&sig=' . $private_key;

 echo $query_string;    
 // https://api.goodrx.com/low-price?name=Lipitor&api_key=MY_API_KEY&sig=MY_SECRET_KEY

It is returning an error saying that my sig is not right.

Could you help me please.

Thank you.

Thomas.

Answer 1

You're not doing your string replacements correctly:

$private_key = str_replace('+', '_', $encoded);
   ^^---new string                       ^---original string
$private_key = str_replace('/', '_', $encoded);
   ^--overwrite previous replacement     ^---with original string again

If you want to chain replacements, you have to do something more like:

$orig = 'foo';
$temp = str_replace(..., $orig);
$temp = str_replace(..., $temp);
...
$final = str_replace(..., $temp);

Note how you pass in the result of the PREVIOUS replacement into the next call, which is what you're not doing. You just keep taking the originals tring, replace one thing, then trash that replacement on the next call. So effectively you're ONLY doing a /->_ replacement, and sending the + as-is.