Account automation clients

import requests

resp = requests.post("https://api-eu.allme.fyi/oauth2/token", data={
    "grant_type": "client_credentials",
    "client_id": "acct_1a2b3c...",
    "client_secret": "...",
})
token = resp.json()["access_token"]

const resp = await fetch("https://api-eu.allme.fyi/oauth2/token", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    grant_type: "client_credentials",
    client_id: "acct_1a2b3c...",
    client_secret: "...",
  }),
});
const { access_token } = await resp.json();

$resp = file_get_contents('https://api-eu.allme.fyi/oauth2/token', false, stream_context_create([
    'http' => [
        'method'  => 'POST',
        'header'  => 'Content-Type: application/x-www-form-urlencoded',
        'content' => http_build_query([
            'grant_type'    => 'client_credentials',
            'client_id'     => 'acct_1a2b3c...',
            'client_secret' => '...',
        ]),
    ],
]));
$token = json_decode($resp, true)['access_token'];

import (
    "encoding/json"
    "fmt"
    "log"
    "net/http"
    "net/url"
)

resp, err := http.PostForm("https://api-eu.allme.fyi/oauth2/token", url.Values{
    "grant_type":    {"client_credentials"},
    "client_id":     {"acct_1a2b3c..."},
    "client_secret": {"..."},
})
if err != nil {
    log.Fatal(err)
}
defer resp.Body.Close()

var body struct {
    AccessToken string `json:"access_token"`
}
if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
    log.Fatal(err)
}
token := body.AccessToken
fmt.Println("bearer token:", token)

using var http = new HttpClient();
var resp = await http.PostAsync("https://api-eu.allme.fyi/oauth2/token",
    new FormUrlEncodedContent(new Dictionary<string, string>
    {
        ["grant_type"]    = "client_credentials",
        ["client_id"]     = "acct_1a2b3c...",
        ["client_secret"] = "...",
    }));
var token = JsonDocument.Parse(await resp.Content.ReadAsStringAsync())
    .RootElement.GetProperty("access_token").GetString();

HttpClient http = HttpClient.newHttpClient();
HttpRequest req = HttpRequest.newBuilder(URI.create("https://api-eu.allme.fyi/oauth2/token"))
    .header("Content-Type", "application/x-www-form-urlencoded")
    .POST(HttpRequest.BodyPublishers.ofString(
        "grant_type=client_credentials"
        + "&client_id=acct_1a2b3c..."
        + "&client_secret=..."))
    .build();
String json = http.send(req, HttpResponse.BodyHandlers.ofString()).body();
// pull access_token out of the JSON with your JSON library of choice

const b64 = (buf) => Buffer.from(buf).toString("base64"); // browser: btoa(String.fromCharCode(...new Uint8Array(buf)))

// 1. RSA-2048 keypair
const kp = await crypto.subtle.generateKey(
  { name: "RSA-OAEP", modulusLength: 2048, publicExponent: new Uint8Array([1,0,1]), hash: "SHA-256" },
  true, ["encrypt","decrypt"]);

// 2. public_key = base64(SPKI)
const publicKey = b64(await crypto.subtle.exportKey("spki", kp.publicKey));

// 3. a random 32-byte passphrase — KEEP THIS; it is never recoverable
const passphrase = b64(crypto.getRandomValues(new Uint8Array(32)));

// 4. PBKDF2-SHA256 100k over the passphrase -> AES-256-GCM wrap key
const salt = crypto.getRandomValues(new Uint8Array(16));
const iv   = crypto.getRandomValues(new Uint8Array(12));
const km = await crypto.subtle.importKey("raw", new TextEncoder().encode(passphrase), "PBKDF2", false, ["deriveKey"]);
const aesKey = await crypto.subtle.deriveKey(
  { name: "PBKDF2", salt, iterations: 100000, hash: "SHA-256" },
  km, { name: "AES-GCM", length: 256 }, false, ["encrypt"]);

// 5. encrypt the PKCS#8 private key
const pkcs8 = await crypto.subtle.exportKey("pkcs8", kp.privateKey);
const data  = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, pkcs8);
const encrypted_private_key = { iter: 100000, salt: b64(salt), iv: b64(iv), data: b64(new Uint8Array(data)) };

// 6. create the service
await fetch("https://api-eu.allme.fyi/api/services", {
  method: "POST",
  headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json" },
  body: JSON.stringify({ name: "CRM", admin_email: "ops@yourco.example", public_key: publicKey, encrypted_private_key }),
});

import base64, os, requests
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization, hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

b64 = lambda b: base64.b64encode(b).decode()

# 1. RSA-2048 keypair
key = rsa.generate_private_key(public_exponent=65537, key_size=2048)

# 2. public_key = base64(SPKI)
public_key = b64(key.public_key().public_bytes(
    serialization.Encoding.DER, serialization.PublicFormat.SubjectPublicKeyInfo))

# 3. a random 32-byte passphrase — KEEP THIS; it is never recoverable
passphrase = b64(os.urandom(32))

# 4. PBKDF2-SHA256 100k over the passphrase -> AES-256-GCM wrap key
salt, iv = os.urandom(16), os.urandom(12)
aes_key = PBKDF2HMAC(hashes.SHA256(), 32, salt, 100_000).derive(passphrase.encode())

# 5. encrypt the PKCS#8 private key (AESGCM appends the tag to the ciphertext)
pkcs8 = key.private_bytes(serialization.Encoding.DER,
    serialization.PrivateFormat.PKCS8, serialization.NoEncryption())
data = AESGCM(aes_key).encrypt(iv, pkcs8, None)
encrypted_private_key = {"iter": 100_000, "salt": b64(salt), "iv": b64(iv), "data": b64(data)}

# 6. create the service
requests.post("https://api-eu.allme.fyi/api/services",
    headers={"Authorization": f"Bearer {token}"},
    json={"name": "CRM", "admin_email": "ops@yourco.example",
          "public_key": public_key, "encrypted_private_key": encrypted_private_key})

import (
    "bytes"
    "crypto/aes"
    "crypto/cipher"
    "crypto/rand"
    "crypto/rsa"
    "crypto/sha256"
    "crypto/x509"
    "encoding/base64"
    "encoding/json"
    "fmt"
    "log"
    "net/http"

    "golang.org/x/crypto/pbkdf2"
)

b64 := base64.StdEncoding.EncodeToString

// 1. RSA-2048 keypair
key, err := rsa.GenerateKey(rand.Reader, 2048)
if err != nil {
    log.Fatal(err)
}

// 2. public_key = base64(SPKI)
spki, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
if err != nil {
    log.Fatal(err)
}
publicKey := b64(spki)

// 3. a random 32-byte passphrase — KEEP THIS; it is never recoverable
pp := make([]byte, 32)
rand.Read(pp)
passphrase := b64(pp)
fmt.Println("service key passphrase (store it now):", passphrase)

// 4. PBKDF2-SHA256 100k over the passphrase -> AES-256-GCM wrap key
salt := make([]byte, 16)
iv := make([]byte, 12)
rand.Read(salt)
rand.Read(iv)
aesKey := pbkdf2.Key([]byte(passphrase), salt, 100000, 32, sha256.New)

// 5. encrypt the PKCS#8 private key (Seal appends the GCM tag)
pkcs8, err := x509.MarshalPKCS8PrivateKey(key)
if err != nil {
    log.Fatal(err)
}
block, err := aes.NewCipher(aesKey)
if err != nil {
    log.Fatal(err)
}
gcm, err := cipher.NewGCM(block)
if err != nil {
    log.Fatal(err)
}
data := gcm.Seal(nil, iv, pkcs8, nil)

// 6. create the service
payload, err := json.Marshal(map[string]any{
    "name": "CRM", "admin_email": "ops@yourco.example",
    "public_key": publicKey,
    "encrypted_private_key": map[string]any{
        "iter": 100000, "salt": b64(salt), "iv": b64(iv), "data": b64(data),
    },
})
if err != nil {
    log.Fatal(err)
}
req, err := http.NewRequest("POST", "https://api-eu.allme.fyi/api/services", bytes.NewReader(payload))
if err != nil {
    log.Fatal(err)
}
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil {
    log.Fatal(err)
}
defer resp.Body.Close()

static string B64(byte[] b) => Convert.ToBase64String(b);

// 1. RSA-2048 keypair
using var rsa = RSA.Create(2048);

// 2. public_key = base64(SPKI)
var publicKey = B64(rsa.ExportSubjectPublicKeyInfo());

// 3. a random 32-byte passphrase — KEEP THIS; it is never recoverable
var passphrase = B64(RandomNumberGenerator.GetBytes(32));

// 4. PBKDF2-SHA256 100k over the passphrase -> AES-256-GCM wrap key
var salt = RandomNumberGenerator.GetBytes(16);
var iv   = RandomNumberGenerator.GetBytes(12);
var aesKey = Rfc2898DeriveBytes.Pbkdf2(passphrase, salt, 100_000, HashAlgorithmName.SHA256, 32);

// 5. encrypt the PKCS#8 private key — data = ciphertext || tag (AesGcm keeps them separate)
var pkcs8  = rsa.ExportPkcs8PrivateKey();
var cipher = new byte[pkcs8.Length];
var tag    = new byte[16];
using var gcm = new AesGcm(aesKey, 16);
gcm.Encrypt(iv, pkcs8, cipher, tag);
var data = cipher.Concat(tag).ToArray();

// 6. POST /api/services with name, admin_email, public_key and
//    new { iter = 100_000, salt = B64(salt), iv = B64(iv), data = B64(data) }

Base64.Encoder b64 = Base64.getEncoder();
SecureRandom rnd = new SecureRandom();

// 1. RSA-2048 keypair
KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
kpg.initialize(2048);
KeyPair kp = kpg.generateKeyPair();

// 2. public_key = base64(SPKI) — an RSA public key's getEncoded() IS the SPKI DER
String publicKey = b64.encodeToString(kp.getPublic().getEncoded());

// 3. a random 32-byte passphrase — KEEP THIS; it is never recoverable
byte[] pp = new byte[32]; rnd.nextBytes(pp);
String passphrase = b64.encodeToString(pp);

// 4. PBKDF2-SHA256 100k over the passphrase -> AES-256 wrap key
byte[] salt = new byte[16]; rnd.nextBytes(salt);
byte[] iv   = new byte[12]; rnd.nextBytes(iv);
SecretKeyFactory f = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
byte[] aesKey = f.generateSecret(
    new PBEKeySpec(passphrase.toCharArray(), salt, 100000, 256)).getEncoded();

// 5. encrypt the PKCS#8 private key (doFinal appends the GCM tag; getEncoded() = PKCS#8 DER)
Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
c.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(aesKey, "AES"), new GCMParameterSpec(128, iv));
byte[] data = c.doFinal(kp.getPrivate().getEncoded());

// 6. POST /api/services with name, admin_email, public_key and
//    { "iter": 100000, "salt": b64(salt), "iv": b64(iv), "data": b64(data) }

// 1. RSA-2048 keypair
$key = openssl_pkey_new(['private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA]);

// 2. public_key = base64(SPKI) — strip the PEM armor to get the base64 DER
$publicKey = preg_replace('/-----[^-]+-----|\s/', '', openssl_pkey_get_details($key)['key']);

// 3. a random 32-byte passphrase — KEEP THIS; it is never recoverable
$passphrase = base64_encode(random_bytes(32));

// 4. PBKDF2-SHA256 100k over the passphrase -> AES-256 wrap key
$salt = random_bytes(16);
$iv   = random_bytes(12);
$aesKey = hash_pbkdf2('sha256', $passphrase, $salt, 100000, 32, true);

// 5. PKCS#8 export + AES-256-GCM — data = ciphertext . tag (openssl keeps them separate)
openssl_pkey_export($key, $pkcs8Pem);   // "-----BEGIN PRIVATE KEY-----" = PKCS#8
$pkcs8  = base64_decode(preg_replace('/-----[^-]+-----|\s/', '', $pkcs8Pem));
$cipher = openssl_encrypt($pkcs8, 'aes-256-gcm', $aesKey, OPENSSL_RAW_DATA, $iv, $tag);
$encryptedPrivateKey = ['iter' => 100000, 'salt' => base64_encode($salt),
    'iv' => base64_encode($iv), 'data' => base64_encode($cipher . $tag)];

// 6. POST /api/services with name, admin_email, public_key, encrypted_private_key