Yaak Sign Plugin

A template function plugin for Yaak that generates SHA1 signatures for API request signing.

Template Functions

This plugin provides three template tags that work together to produce a consistent signature across a single request:

Tag	Args	Description
sign.timestamp	—	Shared millisecond timestamp for the current request
sign.nonce	—	Shared random 16-character nonce for the current request
sign.signature	appid, secret	SHA1 signature derived from appid, secret, timestamp, and nonce

The timestamp and nonce are cached for 5 seconds, so all three tags produce consistent values within the same request.

How It Works

sign.signature concatenates the parameters in alphabetical order and hashes with SHA1:

appid={appid}&nonce={nonce}&secret={secret}&timestamp={timestamp}

The nonce and timestamp values are automatically sourced from the shared cache, ensuring they match whatever sign.nonce and sign.timestamp render to in the same request.

Usage

all fields generated by the plugin

Use all three tags so the body values stay in sync with the signature:

{
  "appid": "my_app_id",
  "timestamp": "${[ sign.timestamp ]}",
  "nonce": "${[ sign.nonce ]}",
  "signature": "${[ sign.signature ]}"
}

The rendered result will look like:

{
  "appid": "my_app_id",
  "timestamp": "1700000000000",
  "nonce": "aB3xZ9qR2mLkWvYt",
  "signature": "a3f1c2d4e5b6789012345678901234567890abcd"
}

Using Environment Variables

Store your appid and secret as environment variables and reference them in the sign.signature args dialog:

{
  "appid": "${[ env.appid ]}",
  "timestamp": "${[ sign.timestamp ]}",
  "nonce": "${[ sign.nonce ]}",
  "signature": "${[ sign.signature ]}"
}

In the sign.signature args dialog, set each field to the corresponding environment variable (e.g. ${[ env.appid ]}).