API keys and HMAC signing

curl https://mcp.echozero.app/api/v1/users/me \
  -H "x-api-key: ez_live_..."

curl https://mcp.echozero.app/api/v1/users/me \
  -H "Authorization: Bearer ez_live_..."

stringToSign = timestamp + METHOD + path + body

API_KEY="ez_live_..."
SECRET="ezs_..."   # secret shown once at key creation
TS=$(date +%s%3N)
REQ_PATH="/api/v1/users/me"
SIG=$(printf '%s' "${TS}GET${REQ_PATH}" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

curl -sS "https://mcp.echozero.app${REQ_PATH}" \
  -H "x-api-key: $API_KEY" \
  -H "x-timestamp: $TS" \
  -H "x-signature: $SIG"

API_KEY="ez_live_..."
SECRET="ezs_..."
TS=$(date +%s%3N)
REQ_PATH="/api/api-keys"
BODY='{"name":"HMAC Test Key"}'
SIG=$(printf '%s' "${TS}POST${REQ_PATH}${BODY}" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

curl -sS -X POST "https://mcp.echozero.app${REQ_PATH}" \
  -H "x-api-key: $API_KEY" \
  -H "Content-Type: application/json" \
  -H "x-timestamp: $TS" \
  -H "x-signature: $SIG" \
  -d "$BODY"

import os
from echozero import EchoZeroClient

client = EchoZeroClient(
    api_key=os.environ["EZ_API_KEY"],
    hmac_secret_key=os.environ["EZ_SECRET_KEY"],
)
me = client.get("/api/v1/users/me", hmac=True)
print(me)

import { EchoZeroClient } from '@echozero/sdk';

const client = new EchoZeroClient({
  apiKey: process.env.EZ_API_KEY!,
  hmacSecretKey: process.env.EZ_SECRET_KEY,
});

const me = await client.get('/api/v1/users/me', { hmac: true });

import { signRestRequest } from '@echozero/sdk';

const headers = await signRestRequest({
  secretKey: process.env.EZ_SECRET_KEY!,
  method: 'GET',
  path: '/api/v1/users/me',
});
// headers['x-timestamp'], headers['x-signature']