Sign a call to Coinbase Pro API with Google Apps Script - google-apps-script

Question

I'm going mad trying to send my first API call to Coinbase Pro using Google Apps Script. In node.js is pretty easy (https://docs.pro.coinbase.com/#signing-a-message) but doing the same with Google scripts is just returning again and again "Invalid Signature".
This is the code I'm using:
function GetMyAccounts () {
var globalvars_CB = {
'apikey' : 'f7d20a*******18c',
'secret' : '******pIIitRbWCv9N/mMWaR*****mGQMuI+m/vSbU1zuh5U6WFiFw==',
'passphrase' : 'ceacdsewfcsa',
'uri' : 'https://api.pro.coinbase.com'
}
var requestPath = '/accounts';
var timestamp = Math.floor(Date.now() / 1000);
var options = {
'method' : 'GET',
'muteHttpExceptions' : true,
'headers' : {
'Content-Type': 'application/json',
'CB-ACCESS-KEY' : globalvars_CB.apikey,
'CB-ACCESS-SIGN' : SignAPICall(globalvars_CB.secret, timestamp, 'GET', requestPath, ''),
'CB-ACCESS-TIMESTAMP' : timestamp,
'CB-ACCESS-PASSPHRASE' : globalvars_CB.passphrase,
}
}
var responseJson = UrlFetchApp.fetch(globalvars_CB.uri+requestPath, options);
Logger.log(responseJson);
}
function SignAPICall(secret, timestamp, method, requestPath, body) {
var what = (timestamp + method + requestPath + body);
var decodedsecret = Utilities.base64Decode(secret).toString();
var hmac = Utilities.computeHmacSha256Signature(what, decodedsecret);
hmac = Utilities.base64Encode(hmac);
return (hmac);
}
I really need help :-) - Thanks!

Answer 1

In your script, it supposes that your request headers except for the value of CB-ACCESS-SIGN and endpoint are correct. Please be careful this.
Modification point:
In the case of Utilities.base64Decode(secret).toString(), the array is converted to the string. I think that this might be the reason of your issue.
When above point is reflected, it becomes as follows.
Modified script:
In this case, the function SignAPICall is modified.
function SignAPICall(secret, timestamp, method, requestPath, body) {
var what = (timestamp + method + requestPath + body);
var decodedsecret = Utilities.base64Decode(secret); // Modified
var res = Utilities.computeHmacSha256Signature(Utilities.newBlob(what).getBytes(), decodedsecret); // Modified
hmac = Utilities.base64Encode(res);
return hmac;
}
In this case, value and key of computeHmacSha256Signature(value, key) are the byte array.
Note:
When I checked above modified script by comparing the sample scripts of the official document, I could confirm that the same result can be obtained.
Unfortunately, I cannot test the request to the API using above modified script while I can confirm that the same signature from the sample script at the official document is retrieved from the above modified script. So please test the request in you environment. When you requested to the API using above modified script, when an error occurs, please check the request headers, endpoint and secret, again.
References:
Signing a Message
base64Decode(encoded)
computeHmacSha256Signature(value, key)

Answer 2

I finally found the solution to it. It was a problem with the type of data I submitted to "Utilities.computeHmacSha256Signature". In the code you can find the function working well.
function SignAndCallAPI(method, requestPath, body) {
var timestamp = Math.floor(Date.now() / 1000).toString();
var what = Utilities.base64Decode(Utilities.base64Encode(timestamp + method + requestPath + body));
var decodedsecret = Utilities.base64Decode(globalvars_CB.secret);
var hmac = Utilities.base64Encode(Utilities.computeHmacSha256Signature(what, decodedsecret));
var options = {
'method' : method,
'muteHttpExceptions' : true,
'headers' : {
'Content-Type': 'application/json',
'CB-ACCESS-KEY' : globalvars_CB.apikey,
'CB-ACCESS-SIGN' : hmac,
'CB-ACCESS-TIMESTAMP' : timestamp,
'CB-ACCESS-PASSPHRASE' : globalvars_CB.passphrase,
}
}
var responseJson = UrlFetchApp.fetch(globalvars_CB.uri+requestPath, options);
Logger.log(responseJson);
return(responseJson);
}