Hivesigner

https://docs.hivesigner.com/
Admin
Hivesigner is a secure transaction signing and authentication platform for the Hive blockchain that...
Tokens:3,560
Snippets:52
Trust Score:7.6
Update:6 months ago
Show doc for...
Tokens:
Raw
### Install HiveSigner SDK

Source: https://docs.hivesigner.com/h/sdk/javascript

Use these commands to add the HiveSigner package to your project dependencies.

```bash
npm install hivesigner --save
```

```bash
yarn add hivesigner
```

--------------------------------

### GET /oauth2/authorize

Source: https://docs.hivesigner.com/h/guides/get-started/hivesigner-oauth2

Initiates the authorization flow for the user to grant the application access.

```APIDOC
## GET /oauth2/authorize

### Description
Redirects the user to the Hivesigner authorization page to grant the application access to their account.

### Method
GET

### Endpoint
https://hivesigner.com/oauth2/authorize

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The unique identifier for your application.
- **redirect_uri** (string) - Required - The URI to redirect to after authorization.
- **scope** (string) - Required - Comma-separated list of permissions (e.g., vote, comment, offline).
- **response_type** (string) - Optional - Use 'code' for the code authorization flow.
```

--------------------------------

### GET /api/me

Source: https://docs.hivesigner.com/h/guides/get-started/hivesigner-oauth2

Retrieves information about the authenticated user.

```APIDOC
## GET /api/me

### Description
Retrieves the profile information of the user associated with the provided access token.

### Method
GET

### Endpoint
https://hivesigner.com/api/me

### Parameters
#### Headers
- **Authorization** (string) - Required - The access token.
```

--------------------------------

### API Request with Access Token (curl)

Source: https://docs.hivesigner.com/h/guides/get-started/hivesigner-oauth2

Example of making an API request using curl, including the access token in the Authorization header. This is used to access user account information or perform operations within the granted scope.

```bash
curl -H "Authorization: ACCESS_TOKEN" https://hivesigner.com/api/me
```

--------------------------------

### Broadcast Transaction Response

Source: https://docs.hivesigner.com/h/guides/get-started/hivesigner-oauth2

Example response after successfully broadcasting a transaction. It includes details of the transaction, such as block information, operations, and signatures.

```json
{
  "errors": null,
  "result": {
    "ref_block_num": 32098,
    "ref_block_prefix": 793145245,
    "expiration": "2021-05-27T05:49:36",
    "operations": [
      ["vote", {
        "voter": "guest123",
        "author": "ecency",
        "permlink": "trustpilot",
        "weight": 10000
      }]
    ],
    "extensions": [],
    "signatures":
 ["205eeb64618343f0f3965a7292dde5a1be00defc31f1df8d103f0c8e8abcd36ff139c2db032549a0969f9abcd7aaffb4d69b8d67ef9d6d386572998c8b778f6f9e"]
  }
}
```

--------------------------------

### Broadcast Vote Transaction (POST)

Source: https://docs.hivesigner.com/h/guides/get-started/hivesigner-oauth2

Example of a POST request to broadcast a vote transaction using an access token. Ensure the Authorization header is set correctly and the body contains the operation details in JSON format.

```http
POST https://hivesigner.com/api/broadcast
  Authorization: ACCESS_TOKEN
  Content-Type: application/json
  Accept: application/json
  Body: {
    "operations": [
      ["vote", {
        "voter": "guest123",
        "author": "ecency",
        "permlink": "trustpilot",
        "weight": 10000
      }]
    ]
  }
```

--------------------------------

### Application Redirect with Access Token

Source: https://docs.hivesigner.com/h/guides/get-started/hivesigner-oauth2

The redirect URI receives the access token and expiration information after successful user authorization in the implicit grant flow.

```url
https://example.com/callback?access_token=ACCESS_TOKEN&expires_in=36000
```

--------------------------------

### Verify HiveSigner Access Token for Image Uploads

Source: https://docs.hivesigner.com/h/use-cases/untitled

This code snippet demonstrates how to verify a HiveSigner access token received via URL parameters. It decodes the token, extracts necessary information, and uses the `hivesigner.Client` to validate the user's account and app permissions before allowing image uploads. Ensure `UPLOAD_LIMITS.app_account` is correctly configured.

```javascript
    // take access token from url params
    const token = ctx.params['accesstoken']
    //decode access token
    const decoded = Buffer.from(b64uToB64(token), 'base64').toString()
    // parse it into object
    const tokenObj = JSON.parse(decoded)
    const signedMessage = tokenObj.signed_message
    if (
        tokenObj.authors
        && tokenObj.authors[0]
        && tokenObj.signatures
        && tokenObj.signatures[0]
        && signedMessage
        && signedMessage.type
        && ['login', 'posting', 'offline', 'code', 'refresh']
        .includes(signedMessage.type)
        && signedMessage.app
    ) {
        // get username from access_token
        const username = tokenObj.authors[0]

        let account = {
            name: '',
            reputation: 0,
        }
        // initialize Hivesigner with user access_token and app_account from imagehoster config
        const cl = new hivesigner.Client({
            app: UPLOAD_LIMITS.app_account,
            accessToken: token,
        })

        await cl.me(function (err: any, res: any) {
            if (!err && res) {
                account = res.account
                APIError.assert(account, APIError.Code.NoSuchAccount)

                ctx.log.warn('uploading app %s', signedMessage.app)
                APIError.assert(username === account.name, APIError.Code.InvalidSignature)
                // user access_token should have same signed app account as imagehoster defined app account.
                APIError.assert(signedMessage.app === UPLOAD_LIMITS.app_account, APIError.Code.InvalidSignature)
                APIError.assert(res.scope.includes('comment'), APIError.Code.InvalidSignature)
                // check if user has authorized posting authority to app_account
                if (account && account.name) {
                    ['posting', 'active', 'owner'].forEach((type) => {
                      account[type].account_auths.forEach((key: string[]) => {
                        if (
                          !validSignature
                          && key[0] === UPLOAD_LIMITS.app_account
                        ) {
                          validSignature = true;
                        }
                      });
                    });
                }
            }
        });
      }

```

--------------------------------

### Code Authorization Link

Source: https://docs.hivesigner.com/h/guides/get-started/hivesigner-oauth2

Use this link for the code authorization flow to obtain offline permissions. Include the 'offline' scope along with other required scopes.

```url
https://hivesigner.com/oauth2/authorize?client_id=CLIENT_ID&redirect_uri=REDIRECT_URI&response_type=code&scope=offline,comment,vote,comment_option,custom_json
```

--------------------------------

### Verify HiveSigner Access Token Signature

Source: https://docs.hivesigner.com/h/use-cases/backend-security

This code snippet verifies that an access_token is signed by the user and checks if the keys match perfectly. It requires `cryptoUtils`, `PublicKey`, and `Signature` from relevant libraries.

```javascript
const message = JSON.stringify({
                signed_message: signedMessage,
                authors: tokenObj.authors,
                timestamp: tokenObj.timestamp,
        })
    let hash = cryptoUtils.sha256(message)
    ...
    account[type].key_auths.forEach((key: string[]) => {
        if (
           !validSignature
           && PublicKey.fromString(key[0]).verify(hash, Signature.fromString(signature))
        ) {
              validSignature = true;
          }
    });
```

--------------------------------

### Token Request using Code

Source: https://docs.hivesigner.com/h/guides/get-started/hivesigner-oauth2

Send a POST request to the Hivesigner API with the received code to obtain a refresh token. This request should be made from your server and include your application secret.

```http
POST https://hivesigner.com/api/oauth2/token?code=THE_CODE_YOU_GOT&client_secret=YOUR_APP_SECRET
```

--------------------------------

### POST /api/oauth2/token

Source: https://docs.hivesigner.com/h/guides/get-started/hivesigner-oauth2

Exchanges an authorization code for an access token.

```APIDOC
## POST /api/oauth2/token

### Description
Exchanges the authorization code received from the redirect for an access token and refresh token. This request should be made from your server.

### Method
POST

### Endpoint
https://hivesigner.com/api/oauth2/token

### Parameters
#### Request Body
- **code** (string) - Required - The authorization code received from the redirect.
- **client_secret** (string) - Required - Your application's secret key.
```

--------------------------------

### Implicit Authorization Link

Source: https://docs.hivesigner.com/h/guides/get-started/hivesigner-oauth2

Construct an authorization link for the implicit grant flow. This link requests a token from the API and is suitable for applications where client secret confidentiality is not guaranteed.

```url
https://hivesigner.com/oauth2/authorize?client_id=CLIENT_ID&redirect_uri=REDIRECT_URI&scope=vote,comment
```

--------------------------------

### POST /api/broadcast

Source: https://docs.hivesigner.com/h/guides/get-started/hivesigner-oauth2

Broadcasts a transaction to the Hive blockchain.

```APIDOC
## POST /api/broadcast

### Description
Broadcasts a signed transaction or operation to the Hive blockchain using the user's access token.

### Method
POST

### Endpoint
https://hivesigner.com/api/broadcast

### Parameters
#### Headers
- **Authorization** (string) - Required - The access token.

#### Request Body
- **operations** (array) - Required - A list of operations to broadcast.

### Response
#### Success Response (200)
- **result** (object) - The transaction broadcast result containing block information and signatures.
```
Tokens:
Raw