Key Management API v1.0.0 eBay Docs

Due to regulatory requirements applicable to our EU/UK sellers, for certain APIs, developers need to add digital signatures to the respective HTTP call.

The Key Management API creates keypairs that are required when creating digital signatures for the following APIs:

• All methods in the Finances API
• issueRefund in the Fulfillment API
• GetAccount in the Trading API
• The following methods in the Post-Order API:
  • Issue Inquiry Refund
  • Issue case refund
  • Issue return refund
  • Process Return Request
  • Approve Cancellation Request
  • Create Cancellation Request

Any eBay API that accesses confidential financial information must include a digital signature for every HTTP call made on behalf of a customer that is domiciled in the EU/UK.

SigningKey

CreateSigningKey eBay Docs

POST

/signing_key

This method creates keypairs using one of the following ciphers:

• ED25519 (Edwards Curve)
• RSA

NOTE

The recommended signature cipher is ED25519 (Edwards Curve) since it uses much shorter keys and therefore decreases the header size. However, for development frameworks that do not support ED25519, RSA is also supported.

Following a successful completion, the following keys are returned:

• Private Key
• Public Key
• Public Key as JWE

Once keypairs are created, developers are strongly advised to create and store a local copy of each keypair for future reference. Although the Public Key, Public Key as JWE, and metadata for keypairs may be retrieved by the getSigningKey and getSigningKeys methods, in order to further ensure the security of confidential client information, eBay does not store the Private Key value in any system. If a developer loses their Private Key they must generate new keypairs using the createSigningKey method.

use Rat\eBaySDK\API\KeyManagementAPI\SigningKey\CreateSigningKey;
use Rat\eBaySDK\Enums\SigningKeyCipher;
use Rat\eBaySDK\Client;

$client = app(Client::class);
$request = new CreateSigningKey(
    signingKeyCipher: SigningKeyCipher::ED25519,
);
$response = $client->execute($request);

GetSigningKey eBay Docs

POST

/signing_key/{signingKeyId}

This method returns the Public Key, Public Key as JWE, and metadata for a specified signingKeyId associated with the application key making the call.

NOTE

It is important to note that the privateKey value is not returned. In order to further ensure the security of confidential client information, eBay does not store the privateKey value in any system. If a developer loses their privateKey they must generate new keypairs using the createSigningKey method.

use Rat\eBaySDK\API\KeyManagementAPI\SigningKey\GetSigningKey;
use Rat\eBaySDK\Client;

$client = app(Client::class);
$request = new GetSigningKey(
    signingKeyId: (string) $signingKeyId,
);
$response = $client->execute($request);

GetSigningKeys eBay Docs

POST

/signing_key/{signingKeyId}

This method returns the Public Key, Public Key as JWE, and metadata for all keypairs associated with the application key making the call.

NOTE

It is important to note that privateKey values are not returned. In order to further ensure the security of confidential client information, eBay does not store privateKey values in any system. If a developer loses their privateKey they must generate new keypairs set using the createSigningKey method.

use Rat\eBaySDK\API\KeyManagementAPI\SigningKey\GetSigningKeys;
use Rat\eBaySDK\Client;

$client = app(Client::class);
$request = new GetSigningKeys();
$response = $client->execute($request);