Make a Signed Request with HMAC

<?php
$apiToken   = 'YOUR_API_TOKEN';
$signingKey = 'YOUR_BASE64_SIGNING_KEY';

$body = json_encode([
    'Store_Code'             => 'YOUR_STORE_CODE',
    'Miva_Request_Timestamp' => time(),
    'Function'               => 'ProductList_Load_Query',
    'Count'                  => 1,
    'Offset'                 => 0
], JSON_UNESCAPED_SLASHES);

if ($body === false) {
    throw new RuntimeException('JSON encoding failed');
}

// Decode the signing key copied from the admin.
$key = base64_decode($signingKey, true);

if ($key === false) {
    throw new RuntimeException('Invalid signing key');
}

// Sign the exact JSON body being sent. true returns the raw binary digest.
$digest    = hash_hmac('sha256', $body, $key, true);
$signature = base64_encode($digest);

$authorization = 'MIVA-HMAC-SHA256 ' . $apiToken . ':' . $signature;

$curl = curl_init('https://www.example.com/mm5/json.mvc');

curl_setopt_array($curl, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $body,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'X-Miva-API-Authorization: ' . $authorization
    ],
    CURLOPT_RETURNTRANSFER => true
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

curl_close($curl);
echo $response;

import crypto from 'node:crypto';

const apiToken = 'YOUR_API_TOKEN';
const signingKey = 'YOUR_BASE64_SIGNING_KEY';

const body = JSON.stringify({
  Store_Code: 'YOUR_STORE_CODE',
  Miva_Request_Timestamp: Math.floor(Date.now() / 1000),
  Function: 'ProductList_Load_Query',
  Count: 1,
  Offset: 0
});

// Decode the signing key, then sign the exact body being sent.
const key = Buffer.from(signingKey, 'base64');
const signature = crypto.createHmac('sha256', key).update(body).digest('base64');

const response = await fetch('https://www.example.com/mm5/json.mvc', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Miva-API-Authorization': `MIVA-HMAC-SHA256 ${apiToken}:${signature}`
  },
  body
});

console.log(await response.text());

import base64
import hashlib
import hmac
import json
import time
import urllib.request

api_token = "YOUR_API_TOKEN"
signing_key = "YOUR_BASE64_SIGNING_KEY"

body = json.dumps({
    "Store_Code": "YOUR_STORE_CODE",
    "Miva_Request_Timestamp": int(time.time()),
    "Function": "ProductList_Load_Query",
    "Count": 1,
    "Offset": 0,
}).encode("utf-8")

# Signing keys from the admin can be missing their trailing "=" padding,
# which Python's decoder requires.
key = base64.b64decode(signing_key + "=" * (-len(signing_key) % 4))

# Sign the exact bytes being sent.
digest = hmac.new(key, body, hashlib.sha256).digest()
signature = base64.b64encode(digest).decode("ascii")

request = urllib.request.Request(
    "https://www.example.com/mm5/json.mvc",
    data=body,
    method="POST",
    headers={
        "Content-Type": "application/json",
        "X-Miva-API-Authorization": f"MIVA-HMAC-SHA256 {api_token}:{signature}",
    },
)

with urllib.request.urlopen(request) as response:
    print(response.read().decode("utf-8"))