API Sicherheit & Authentifizierung

curl -X GET "https://buchhaltgenie.at/api/v1/invoices" \
  -H "Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json"

// Niemals API-Keys im Code speichern!
const apiKey = process.env.BUCHHALTGENIE_API_KEY;
 
const response = await fetch('https://buchhaltgenie.at/api/v1/invoices', {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${apiKey}`,
    'Content-Type': 'application/json',
    'Accept': 'application/json',
  },
});
 
if (!response.ok) {
  throw new Error(`API Error: ${response.status}`);
}
 
const data = await response.json();

import os
import requests
 
# Niemals API-Keys im Code speichern!
api_key = os.environ.get('BUCHHALTGENIE_API_KEY')
 
response = requests.get(
    'https://buchhaltgenie.at/api/v1/invoices',
    headers={
        'Authorization': f'Bearer {api_key}',
        'Content-Type': 'application/json',
        'Accept': 'application/json',
    }
)
 
response.raise_for_status()
data = response.json()

<?php
// Niemals API-Keys im Code speichern!
$apiKey = getenv('BUCHHALTGENIE_API_KEY');
 
$ch = curl_init('https://buchhaltgenie.at/api/v1/invoices');
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . $apiKey,
        'Content-Type: application/json',
        'Accept: application/json',
    ],
    CURLOPT_RETURNTRANSFER => true,
]);
 
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
 
if ($httpCode !== 200) {
    throw new Exception("API Error: $httpCode");
}
 
$data = json_decode($response, true);
?>

┌─────────────┐                              ┌─────────────┐
│   Client    │                              │  API Server │
└──────┬──────┘                              └──────┬──────┘
       │                                            │
       │  1. API Request mit Access Token           │
       │ ─────────────────────────────────────────► │
       │                                            │
       │  2. 401 Unauthorized (Token expired)       │
       │ ◄───────────────────────────────────────── │
       │                                            │
       │  3. POST /oauth/token (Refresh Token)      │
       │ ─────────────────────────────────────────► │
       │                                            │
       │  4. Neues Access Token + Refresh Token     │
       │ ◄───────────────────────────────────────── │
       │                                            │
       │  5. API Request mit neuem Access Token     │
       │ ─────────────────────────────────────────► │
       │                                            │
       │  6. 200 OK (Erfolg)                        │
       │ ◄───────────────────────────────────────── │
       │                                            │

interface TokenResponse {
  access_token: string;
  refresh_token: string;
  expires_in: number; // Sekunden bis Ablauf
  token_type: 'Bearer';
}
 
async function refreshAccessToken(refreshToken: string): Promise<TokenResponse> {
  const response = await fetch('https://auth.buchhaltgenie.at/oauth/token', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
    },
    body: new URLSearchParams({
      grant_type: 'refresh_token',
      refresh_token: refreshToken,
      client_id: process.env.BUCHHALTGENIE_CLIENT_ID!,
      client_secret: process.env.BUCHHALTGENIE_CLIENT_SECRET!,
    }),
  });
 
  if (!response.ok) {
    throw new Error('Token refresh failed');
  }
 
  return response.json();
}
 
// Automatische Token-Verwaltung
class TokenManager {
  private accessToken: string | null = null;
  private refreshToken: string | null = null;
  private expiresAt: Date | null = null;
 
  async getAccessToken(): Promise<string> {
    // Token noch gültig? (mit 5 Minuten Puffer)
    if (this.accessToken && this.expiresAt && this.expiresAt > new Date(Date.now() + 5 * 60 * 1000)) {
      return this.accessToken;
    }
 
    // Token erneuern
    if (this.refreshToken) {
      const tokens = await refreshAccessToken(this.refreshToken);
      this.accessToken = tokens.access_token;
      this.refreshToken = tokens.refresh_token;
      this.expiresAt = new Date(Date.now() + tokens.expires_in * 1000);
      return this.accessToken;
    }
 
    throw new Error('No valid token available - re-authentication required');
  }
}

import crypto from 'crypto';
 
function verifyWebhookSignature(
  payload: string,
  signature: string,
  secret: string
): boolean {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
 
  // Timing-sicherer Vergleich!
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(`sha256=${expectedSignature}`)
  );
}
 
// Express.js Beispiel
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-buchhaltgenie-signature'] as string;
  const payload = req.body.toString();
 
  if (!verifyWebhookSignature(payload, signature, process.env.WEBHOOK_SECRET!)) {
    console.error('Ungültige Webhook-Signatur');
    return res.status(401).send('Unauthorized');
  }
 
  const event = JSON.parse(payload);
  // Event sicher verarbeiten...
 
  res.status(200).send('OK');
});

import hmac
import hashlib
from flask import Flask, request
 
app = Flask(__name__)
 
def verify_webhook_signature(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
 
    # Timing-sicherer Vergleich!
    return hmac.compare_digest(signature, f"sha256={expected}")
 
@app.route('/webhook', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-BuchhaltGenie-Signature', '')
 
    if not verify_webhook_signature(request.data, signature, WEBHOOK_SECRET):
        return 'Unauthorized', 401
 
    event = request.json
    # Event sicher verarbeiten...
 
    return 'OK', 200

<?php
function verifyWebhookSignature($payload, $signature, $secret) {
    $expected = 'sha256=' . hash_hmac('sha256', $payload, $secret);
    // Timing-sicherer Vergleich!
    return hash_equals($expected, $signature);
}
 
$signature = $_SERVER['HTTP_X_BUCHHALTGENIE_SIGNATURE'] ?? '';
$payload = file_get_contents('php://input');
 
if (!verifyWebhookSignature($payload, $signature, $webhookSecret)) {
    http_response_code(401);
    die('Unauthorized');
}
 
$event = json_decode($payload, true);
// Event sicher verarbeiten...
 
http_response_code(200);
echo 'OK';
?>