向量api，401 http错误代码，签名不匹配。授权签名或客户凭证错误

Question

我正在尝试使用here maps vector-tiles api。我已经从developer.here.com收到了我的凭据。我为HERE SDK for Android or iOS (Lite Edition)创建了一个应用。然后，我创建了凭据，并将here.access.key.id用作密钥，并将here.access.key.secret用作秘密。

我正在使用oauth-sign npm package（在撰写此问题时每周下载约14.5MM，因此我认为它应该可以正常工作），并带有以下代码段：< / p>

import { hmacsign256 } from 'oauth-sign'

export const API_URL = 'https://account.api.here.com/oauth2/token'
export const nonceLength = 2**5

export interface TokenResponse {
  AccessToken: string
  TokenType: string
  ExpiresIn: number
}

export const generateNonce = (length: number): string => {
  let s = ''
  do {
    s += Math.random().toString(36).substr(2)
  } while (s.length < length)
  return s.substr(0, length)
}

export const fetchNewTokenFromAPI = async ({ key, secret }: { key: string, secret: string }): Promise<TokenResponse> => {
  const url = API_URL
  const method = 'POST'
  const body = 'grant_type=client_credentials'
  const auth = {
    oauth_consumer_key: key,
    oauth_nonce: generateNonce(nonceLength),
    oauth_signature_method: 'HMAC-SHA256',
    oauth_timestamp: String(Math.round(new Date().getTime() / 1000)),
    oauth_version: '1.0',
  }

  const sig = encodeURIComponent(hmacsign256(method, API_URL, auth, key, secret))
  const headers = {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Authorization': `OAuth oauth_consumer_key="${auth['oauth_consumer_key']}",oauth_nonce="${auth['oauth_nonce']}",oauth_signature="${sig}",oauth_signature_method="HMAC-SHA256",oauth_timestamp="${auth['oauth_timestamp']}",oauth_version="1.0"`
  }

  const options: RequestInit = {
    method,
    headers,
    body,
    mode: 'cors',
  }

  const response = await fetch(url, options)
  if (response.ok)
    throw new Error(`expected 200 status, received ${response.status}`)

  return await response.json()
}

运行该函数时，我从api中收到以下信息：

{
  "error": "invalid_client"
  "errorCode": 401300
  "errorId": "ERROR-32e365d0-11ce-4fff-86d7-5ca51970e017"
  "error_description": "errorCode: '401300'. Signature mismatch. Authorization signature or client credential is wrong."
  "httpStatus": 401
  "message": "Signature mismatch. Authorization signature or client credential is wrong."
}

Answer 1

在邮递员上测试令牌生成API之后，共享CURL请求。使用者密钥和使用者密钥分别在此处。access.key.id和key.secret。签名方法：HMAC-SHA1，版本：1.0

 curl -X POST \
  https://account.api.here.com/oauth2/token \
  -H 'Authorization: OAuth' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Postman-Token: xxxxxxxxxxxx' \
  -H 'cache-control: no-cache' \
  -d grant_type=client_credentials

Answer 2

卷曲-X POST \   https://account.api.here.com/oauth2/token \   -H'接受： / '\   -H'Accept-Encoding：gzip，deflate'\   -H'授权：OAuth'\   -H'缓存控制：无缓存'\   -H'连接：保持活动状态'\   -H“内容长度：238” \   -H'内容类型：application / x-www-form-urlencoded'\   -H'主机：account.api.here.com'\   -H'邮递员令牌：xxxxxxxxx'\   -H'用户代理：PostmanRuntime / 7.20.1'\   -H'cache-control：no-cache'\   -d'grant_type = client_credentials＆oauth_consumer_key = xxxx＆oauth_signature_method = HMAC-SHA256＆oauth_timestamp = 1576653105＆oauth_nonce = xxx＆oauth_version = 1.0＆oauth_signature = xxx'