A private key is the confidential half of an asymmetric key pair. Keep it secret: possessing it proves control of the identity and allows request signatures that a corresponding public key can verify. section 30.2 section 30.3.1
Use private keys according to these rules:
- Generate the key pair on the user side; never transmit the private key to the API server. section 30.3.1
- Sign the exact request payload with the private key, then let the server verify it using the registered public key. section 30.3.3
Signing an API payload
A Node.js client can pass a string payload and its private key to crypto.createSign('rsa-sha256'), producing a signature for the server to verify. section 30.3.3
Listing 30.1 Generating a set of credentials
const crypto = require('crypto');
interface KeyPair {
publicKey: string;
privateKey: string;
}
function generateCredentials(size = 2048): Promise<KeyPair> {
return new Promise<KeyPair>( (resolve, reject) => {
crypto.generateKeyPair('rsa', { modulusLength: size },
(err, pub, priv) => {
if (err) { return reject(err); } #1
return resolve({
publicKey: pub.export({ type: 'pkcs1', format: 'pem' }), #2
privateKey: priv.export({ type: 'pkcs1', format: 'pem' })
});
});
});
}
See a TypeScript example generating an RSA key pair and exporting both keys as PEM strings. section 30.3.1
