Automate Watcho activations and renewals from your own software

const crypto = require('crypto');
const sts = ['POST', '/api/v1/activate', '', ts, nonce,
  crypto.createHash('sha256').update(body, 'utf8').digest('hex')].join('\n');
const signature = crypto.createHmac('sha256', apiSecret).update(sts, 'utf8').digest('hex');

import hashlib, hmac
sts = "\n".join(["POST", "/api/v1/activate", "", ts, nonce, hashlib.sha256(body).hexdigest()])
signature = hmac.new(api_secret.encode(), sts.encode(), hashlib.sha256).hexdigest()

BODY_HASH=$(printf '%s' "$BODY" | openssl dgst -sha256 -hex | sed 's/^.*= //')
SIG=$(printf 'POST\n/api/v1/activate\n\n%s\n%s\n%s' "$TS" "$NONCE" "$BODY_HASH" \
      | openssl dgst -sha256 -hmac "$SPECTO_API_SECRET" -hex | sed 's/^.*= //')

<?php
/**
 * Specto LCO API — PHP client example (PHP 7.4+, ext-curl).
 *
 *   SPECTO_API_BASE=https://api.spectotv.com/api/v1 SPECTO_API_KEY=spk_... SPECTO_API_SECRET=sps_... php specto_client.php
 *
 * Keep the secret on your server. Never ship it in a mobile app or browser JavaScript.
 */
final class SpectoClient
{
    private string $base; private string $key; private string $secret;

    public function __construct(string $base, string $key, string $secret)
    {
        $this->base = rtrim($base, '/'); $this->key = $key; $this->secret = $secret;
    }

    /** Signature = hex(HMAC-SHA256(secret, METHOD\nPATH\nCANONICAL_QUERY\nTIMESTAMP\nNONCE\nhex(sha256(body)))) */
    public static function sign(string $secret, string $method, string $path, string $query, string $ts, string $nonce, string $body): string
    {
        $canon = '';
        if ($query !== '') {
            $pairs = [];
            foreach (explode('&', $query) as $p) {
                if ($p === '') continue;
                $kv = explode('=', $p, 2);
                $pairs[] = [rawurlencode(rawurldecode(str_replace('+', '%20', $kv[0]))), rawurlencode(rawurldecode(str_replace('+', '%20', $kv[1] ?? '')))];
            }
            usort($pairs, function ($a, $b) { return $a[0] === $b[0] ? strcmp($a[1], $b[1]) : strcmp($a[0], $b[0]); });
            $canon = implode('&', array_map(function ($p) { return $p[0] . '=' . $p[1]; }, $pairs));
        }
        $sts = strtoupper($method) . "\n" . $path . "\n" . $canon . "\n" . $ts . "\n" . $nonce . "\n" . hash('sha256', $body);
        return hash_hmac('sha256', $sts, $secret);
    }

    public function request(string $method, string $endpoint, array $query = [], ?array $body = null, ?string $idempotencyKey = null): array
    {
        $path = '/api/v1/' . ltrim($endpoint, '/');
        $qs = $query ? http_build_query($query, '', '&', PHP_QUERY_RFC3986) : '';
        $json = $body === null ? '' : json_encode($body, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
        $ts = (string) time();
        $nonce = bin2hex(random_bytes(16));
        $headers = [
            'X-API-Key: ' . $this->key,
            'X-Timestamp: ' . $ts,
            'X-Nonce: ' . $nonce,
            'X-Signature: ' . self::sign($this->secret, $method, $path, $qs, $ts, $nonce, $json),
            'Accept: application/json',
        ];
        if ($method === 'POST') { $headers[] = 'Content-Type: application/json'; }
        if ($idempotencyKey !== null) { $headers[] = 'Idempotency-Key: ' . $idempotencyKey; }
        // optional extra headers, e.g. when your own outbound proxy needs them (JSON array of "Name: value")
        foreach ((array) json_decode((string) getenv('SPECTO_EXTRA_HEADERS'), true) as $h) { $headers[] = $h; }
        $url = preg_replace('#/api/v1$#', '', $this->base) . $path . ($qs ? '?' . $qs : '');
        $ch = curl_init($url);
        curl_setopt_array($ch, [CURLOPT_CUSTOMREQUEST => $method, CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => $headers,
            CURLOPT_TIMEOUT => 90, CURLOPT_SSL_VERIFYPEER => true]);
        if ($method === 'POST') { curl_setopt($ch, CURLOPT_POSTFIELDS, $json); }
        $raw = curl_exec($ch);
        $status = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
        $err = curl_error($ch);
        curl_close($ch);
        if ($raw === false) { throw new RuntimeException('Network error: ' . $err); }
        return ['http' => $status, 'body' => json_decode((string) $raw, true)];
    }
}

/* ---------------------------------------------------------------------------
   Demo: balance → plans → (optional) activation with a retry-safe idempotency key
         → transaction lookup.  Set SPECTO_DEMO_MOBILE to run the activation.
   --------------------------------------------------------------------------- */
if (PHP_SAPI === 'cli' && realpath($argv[0]) === __FILE__) {
    $api = new SpectoClient(getenv('SPECTO_API_BASE') ?: 'https://api.spectotv.com/api/v1', getenv('SPECTO_API_KEY') ?: '', getenv('SPECTO_API_SECRET') ?: '');

    $bal = $api->request('GET', 'balance');
    echo "balance: HTTP {$bal['http']} ", $bal['body']['code'] ?? '?', ' ', json_encode($bal['body']['data']['wallet_balance'] ?? null), "\n";

    $plans = $api->request('GET', 'plans');
    $list = $plans['body']['data']['plans'] ?? [];
    echo "plans: ", count($list), "\n";

    $mobile = getenv('SPECTO_DEMO_MOBILE');
    if ($mobile && $list) {
        // Create the key BEFORE the first attempt and store it with your order.
        $key = 'order-' . bin2hex(random_bytes(8));
        $r = null;
        for ($attempt = 1; $attempt <= 3; $attempt++) {
            try { $r = $api->request('POST', 'activate', [], ['full_name' => 'Demo Customer', 'mobile' => $mobile, 'plan_id' => $list[0]['id']], $key); break; }
            catch (RuntimeException $e) { sleep($attempt); }   // network error: retry with the SAME key
        }
        $code = $r['body']['code'] ?? 'NO_RESPONSE';
        echo "activate: HTTP ", $r['http'] ?? 0, " $code\n";
        if ($code === 'OK') {
            $d = $r['body']['data'];
            echo "  transaction {$d['transaction_id']} · subscriber {$d['customer']['subscriber_id']} · expires {$d['expiry']['new']} · wallet {$d['wallet']['before']} → {$d['wallet']['after']}\n";
        } elseif ($code === 'INSUFFICIENT_BALANCE') {
            echo "  top up needed: short by ", $r['body']['data']['shortfall'], "\n";
        } else {
            echo "  ", $r['body']['message'] ?? '', "\n";
        }
        $t = $api->request('GET', 'transaction', ['idempotency_key' => $key]);
        echo "lookup: ", $t['body']['data']['status'] ?? ($t['body']['code'] ?? '?'), "\n";
    }
}

#!/usr/bin/env node
/**
 * Specto LCO API — Node.js 18+ example client (no dependencies; uses global fetch).
 *
 *   SPECTO_API_BASE=https://api.spectotv.com/api/v1 SPECTO_API_KEY=spk_... SPECTO_API_SECRET=sps_... node specto_client.js
 *
 * Server-side only: never put the API secret in browser or mobile-app code.
 */
'use strict';
const crypto = require('crypto');

const enc = (s) => encodeURIComponent(s).replace(/[!'()*]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase());

function canonicalQuery(query) {
  if (!query) return '';
  const pairs = query.split('&').filter(Boolean).map((p) => {
    const i = p.indexOf('=');
    const k = decodeURIComponent((i < 0 ? p : p.slice(0, i)).replace(/\+/g, '%20'));
    const v = i < 0 ? '' : decodeURIComponent(p.slice(i + 1).replace(/\+/g, '%20'));
    return [enc(k), enc(v)];
  });
  pairs.sort((a, b) => (a[0] === b[0] ? (a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0) : a[0] < b[0] ? -1 : 1));
  return pairs.map((p) => p[0] + '=' + p[1]).join('&');
}

function sign(secret, method, path, query, ts, nonce, body) {
  const sts = [method.toUpperCase(), path, canonicalQuery(query), ts, nonce,
    crypto.createHash('sha256').update(body, 'utf8').digest('hex')].join('\n');
  return crypto.createHmac('sha256', secret).update(sts, 'utf8').digest('hex');
}

class SpectoClient {
  constructor(base, key, secret) {
    this.base = base.replace(/\/+$/, '');
    this.origin = this.base.replace(/\/api\/v1$/, '');
    this.key = key; this.secret = secret;
  }
  async request(method, endpoint, query = {}, body = null, idempotencyKey = null) {
    const path = '/api/v1/' + endpoint.replace(/^\/+/, '');
    const qs = Object.entries(query).map(([k, v]) => enc(k) + '=' + enc(String(v))).join('&');
    const raw = body === null ? '' : JSON.stringify(body);
    const ts = String(Math.floor(Date.now() / 1000));
    const nonce = crypto.randomBytes(16).toString('hex');
    const headers = {
      'X-API-Key': this.key, 'X-Timestamp': ts, 'X-Nonce': nonce,
      'X-Signature': sign(this.secret, method, path, qs, ts, nonce, raw), Accept: 'application/json',
    };
    if (method === 'POST') headers['Content-Type'] = 'application/json';
    if (idempotencyKey) headers['Idempotency-Key'] = idempotencyKey;
    // optional extra headers, e.g. for your own outbound proxy (JSON array of "Name: value")
    for (const h of JSON.parse(process.env.SPECTO_EXTRA_HEADERS || '[]')) { const i = h.indexOf(':'); headers[h.slice(0, i).trim()] = h.slice(i + 1).trim(); }
    const res = await fetch(this.origin + path + (qs ? '?' + qs : ''), { method, headers, body: method === 'POST' ? raw : undefined });
    return { http: res.status, body: await res.json() };
  }
}

module.exports = { SpectoClient, sign, canonicalQuery };

if (require.main === module) {
  // Demo: balance -> subscription lookup -> (optional) advance renewal with a retry-safe key -> transaction lookup.
  (async () => {
    const c = new SpectoClient(process.env.SPECTO_API_BASE || 'https://api.spectotv.com/api/v1', process.env.SPECTO_API_KEY || '', process.env.SPECTO_API_SECRET || '');
    const bal = await c.request('GET', 'balance');
    console.log('balance:', bal.http, bal.body.code, bal.body.data && bal.body.data.wallet_balance);
    const sid = process.env.SPECTO_DEMO_SUBSCRIBER;
    if (!sid) return;
    const sub = await c.request('GET', 'subscription', { subscriber_id: sid });
    console.log('subscription:', sub.http, sub.body.code, sub.body.data && sub.body.data.expiry_date);
    const planId = process.env.SPECTO_DEMO_PLAN;
    if (!planId) return;
    const key = 'adv-' + crypto.randomBytes(8).toString('hex');   // store with your order before sending
    let res;
    for (let attempt = 1; attempt <= 3; attempt++) {
      try { res = await c.request('POST', 'advance-renew', {}, { subscriber_id: sid, plan_id: planId }, key); break; }
      catch (e) { await new Promise((r) => setTimeout(r, 1000 * attempt)); }   // network error: retry with the SAME key
    }
    console.log('advance-renew:', res.http, res.body.code, res.body.message, res.body.data && res.body.data.expiry && res.body.data.expiry.start_date);
    const t = await c.request('GET', 'transaction', { idempotency_key: key });
    console.log('lookup:', t.body.data && t.body.data.status);
  })().catch((e) => { console.error(e); process.exit(1); });
}

#!/usr/bin/env python3
"""
Specto LCO API — Python 3 example client (standard library only).

  SPECTO_API_BASE=https://api.spectotv.com/api/v1 SPECTO_API_KEY=spk_... SPECTO_API_SECRET=sps_... python3 specto_client.py

Keep the secret on your server only.
"""
import hashlib, hmac, json, os, secrets, time, urllib.error, urllib.parse, urllib.request


def canonical_query(query: str) -> str:
    if not query:
        return ""
    pairs = []
    for part in query.split("&"):
        if not part:
            continue
        k, _, v = part.partition("=")
        k = urllib.parse.unquote(k.replace("+", "%20"))
        v = urllib.parse.unquote(v.replace("+", "%20"))
        pairs.append((urllib.parse.quote(k, safe="-_.~"), urllib.parse.quote(v, safe="-_.~")))
    pairs.sort()
    return "&".join(f"{k}={v}" for k, v in pairs)


def sign(secret: str, method: str, path: str, query: str, ts: str, nonce: str, body: bytes) -> str:
    sts = "\n".join([method.upper(), path, canonical_query(query), ts, nonce, hashlib.sha256(body).hexdigest()])
    return hmac.new(secret.encode(), sts.encode(), hashlib.sha256).hexdigest()


class SpectoClient:
    def __init__(self, base: str, key: str, secret: str):
        self.base = base.rstrip("/")
        self.origin = self.base[: -len("/api/v1")] if self.base.endswith("/api/v1") else self.base
        self.key, self.secret = key, secret

    def request(self, method, endpoint, query=None, body=None, idempotency_key=None):
        path = "/api/v1/" + endpoint.lstrip("/")
        qs = urllib.parse.urlencode(query or {}, quote_via=urllib.parse.quote)
        raw = b"" if body is None else json.dumps(body, separators=(",", ":"), ensure_ascii=False).encode()
        ts, nonce = str(int(time.time())), secrets.token_hex(16)
        headers = {
            "X-API-Key": self.key, "X-Timestamp": ts, "X-Nonce": nonce,
            "X-Signature": sign(self.secret, method, path, qs, ts, nonce, raw), "Accept": "application/json",
        }
        if method == "POST":
            headers["Content-Type"] = "application/json"
        if idempotency_key:
            headers["Idempotency-Key"] = idempotency_key
        # optional extra headers, e.g. for your own outbound proxy (JSON array of "Name: value")
        for h in json.loads(os.environ.get("SPECTO_EXTRA_HEADERS", "[]")):
            k, _, v = h.partition(":"); headers[k.strip()] = v.strip()
        url = self.origin + path + ("?" + qs if qs else "")
        req = urllib.request.Request(url, data=raw if method == "POST" else None, headers=headers, method=method)
        try:
            with urllib.request.urlopen(req, timeout=90) as r:
                return r.status, json.loads(r.read())
        except urllib.error.HTTPError as e:   # 4xx/5xx still carry the JSON envelope
            return e.code, json.loads(e.read() or b"{}")


if __name__ == "__main__":
    # Demo: balance -> plans -> (optional) renewal with a retry-safe idempotency key -> lookup.
    c = SpectoClient(os.environ.get("SPECTO_API_BASE", "https://api.spectotv.com/api/v1"),
                     os.environ.get("SPECTO_API_KEY", ""), os.environ.get("SPECTO_API_SECRET", ""))
    status, bal = c.request("GET", "balance")
    print("balance:", status, bal.get("code"), bal.get("data", {}).get("wallet_balance"))
    status, plans = c.request("GET", "plans")
    plan_list = plans.get("data", {}).get("plans", [])
    print("plans:", len(plan_list))

    subscriber = os.environ.get("SPECTO_DEMO_SUBSCRIBER")
    if subscriber and plan_list:
        key = "renew-" + secrets.token_hex(8)          # store with your order before sending
        result = None
        for attempt in range(1, 4):
            try:
                result = c.request("POST", "renew", body={"subscriber_id": subscriber, "plan_id": plan_list[0]["id"]}, idempotency_key=key)
                break
            except urllib.error.URLError:               # network problem: retry with the SAME key
                time.sleep(attempt)
        status, body = result
        print("renew:", status, body.get("code"), body.get("message"))
        if body.get("code") == "OK":
            d = body["data"]
            print("  expiry", d["expiry"]["previous"], "->", d["expiry"]["new"], "| wallet", d["wallet"]["before"], "->", d["wallet"]["after"])
        print("lookup:", c.request("GET", "transaction", {"idempotency_key": key})[1].get("data", {}).get("status"))