Compose protected authorization requests without exposing secrets.

# Nodra REST uses a signed request. Generate the timestamp, nonce,
# SHA-256 body digest and HMAC-SHA256 signature server-side.
#
# Never paste NODRA_CREDENTIAL into a browser or API client that syncs secrets.

BODY='{"agentId":"finance-agent","resourceId":"stripe","action":"payments.submit","context":{"environment":"production","amount":25000}}'
TIMESTAMP="$(date +%s)"
NONCE="$(python - <<'PY'
import uuid
print(uuid.uuid4())
PY
)"
BODY_SHA="$(printf '%s' "$BODY" | openssl dgst -sha256 -hex | awk '{print $2}')"
CANONICAL="$(printf 'v1\n%s\n%s\n%s' "$TIMESTAMP" "$NONCE" "$BODY_SHA")"
SIGNATURE="$(printf '%s' "$CANONICAL" | openssl dgst -sha256 -hmac "$NODRA_CREDENTIAL" -hex | awk '{print $2}')"

curl --fail-with-body \
  --request POST "$NODRA_BASE_URL/api/v1/authorize" \
  --header "content-type: application/json" \
  --header "x-nodra-credential: $NODRA_CREDENTIAL" \
  --header "x-nodra-timestamp: $TIMESTAMP" \
  --header "x-nodra-nonce: $NONCE" \
  --header "x-nodra-signature: v1=$SIGNATURE" \
  --data "$BODY"