Quickstart

openssl genpkey -algorithm ed25519 -out lunixi-private.pem
openssl pkey -in lunixi-private.pem -pubout -out lunixi-public.pem

import crypto from 'crypto';
import fs from 'fs';
 
const BASE = 'https://api-gateway.lunixi.com';
const KID = process.env.LUNIXI_KEY_ID!;
const privateKey = crypto.createPrivateKey(
  fs.readFileSync(process.env.LUNIXI_PRIVATE_KEY_PATH!),
);
 
export async function mintToken() {
  const method = 'POST';
  const url = '/api/v1/auth/token';
  const date = new Date().toISOString();
  const nonce = crypto.randomUUID();
 
  // 🔴 This request has NO BODY → the `Digest:` line is NOT added to the
  // canonical string at all. Adding it empty breaks the signature. On requests
  // with a body it goes in as the fifth line.
  const canonical = [
    method.toUpperCase(),
    url,
    `X-Date:${date}`,
    `X-Nonce:${nonce}`,
  ].join('\n');
 
  const signature = crypto
    .sign(null, Buffer.from(canonical), privateKey)
    .toString('base64');
 
  const res = await fetch(BASE + url, {
    method,
    headers: {
      'X-Key-Id': KID,
      'X-Date': date,
      'X-Nonce': nonce,
      'X-Signature': signature,
    },
  });
 
  if (!res.ok) {
    const err = await res.json();
    throw new Error(`${err.code}: ${err.message}`);
  }
 
  return res.json(); // { access_token, expires_in, expires_at, session_id, ... }
}

let cached: { token: string; expiresAt: number } | null = null;
 
export async function getToken(): Promise<string> {
  const now = Math.floor(Date.now() / 1000);
  if (cached && cached.expiresAt - 30 > now) return cached.token;
 
  const t = await mintToken();
  cached = { token: t.access_token, expiresAt: t.expires_at };
  return cached.token;
}