Getting Started

gem install jwt

npm install jsonwebtoken

composer require firebase/php-jwt

dotnet add package System.IdentityModel.Tokens.Jwt

# app.rb
require 'jwt'
require 'sinatra'

NMBR_API_SECRET = ENV['NMBR_API_SECRET'] || 'invalid-secret'

# Sign request bodies with the SHA-256 hash of your API Secret,
# formatted as a hex string (though base64 is supported too)
SIGNING_HASH = Digest::SHA256.hexdigest(NMBR_API_SECRET)

post '/sign_nmbr_request' do
  # Your app should authenticate the user and
  # ensure they are authorized to administer payroll
  payload = JSON.parse(request.body.read)
  token = JWT.encode(payload, SIGNING_HASH, 'HS256')
  status 201
  body token
end

# Start the server
set :port, ENV['PORT'] || 8080
run Sinatra::Application

// server.js
import jwt from 'jsonwebtoken';
import express from 'express';
import crypto from 'node:crypto';

const PORT = process.env.PORT ? parseInt(process.env.PORT) : 8080;
const NMBR_API_SECRET = process.env.NMBR_API_SECRET ?? 'invalid-secret';

const SIGNING_HASH = crypto // Sign request bodies
  .createHash('sha256') // with the SHA-256 hash
  .update(NMBR_API_SECRET) // of your API Secret
  .digest('hex'); // formatted as a hex string
// (though base64 is supported too)
const app = express();

app.post(
  '/sign_nmbr_request',
  // Your app should authenticate the user and
  // ensure they are authorized to administer payroll
  express.json(),
  (req, res) => res.status(201).send(jwt.sign(req.body, SIGNING_HASH)),
);

app.listen(PORT, () => console.log(`Running on port ${PORT}`));

<?php
# index.php
require_once 'vendor/autoload.php';
use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$NMBR_API_SECRET = getenv('NMBR_API_SECRET') ?: 'invalid-secret';

# Sign request bodies with the SHA-256 hash of your API Secret,
# formatted as a hex string (though base64 is supported too)
$SIGNING_HASH = hash('sha256', $NMBR_API_SECRET);

# Create a simple router for demonstration purposes
$requestMethod = $_SERVER['REQUEST_METHOD'];
$requestUri = $_SERVER['REQUEST_URI'];

if ($requestMethod === 'POST' && $requestUri === '/sign_nmbr_request') {
    # Your app should authenticate the user and
    # ensure they are authorized to administer payroll
    $payload = json_decode(file_get_contents('php://input'), true);
    $token = JWT::encode($payload, $SIGNING_HASH, 'HS256');
    http_response_code(201);
    echo $token;
} else {
    http_response_code(404);
    echo 'Not Found';
}

// YourController.cs
// Install-Package System.IdentityModel.Tokens.Jwt
// Install-Package Microsoft.AspNetCore.WebUtilities
// Install-Package Newtonsoft.Json
using System;
using System.Text;
using Microsoft.AspNetCore.Mvc;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;
using Microsoft.AspNetCore.WebUtilities;
using Newtonsoft.Json.Linq;

namespace YourNamespace
{
    public class YourController : ControllerBase
    {
        private readonly string _nmbrApiSecret = Environment.GetEnvironmentVariable("NMBR_API_SECRET") ?? "invalid-secret";

        // Sign request bodies with the SHA-256 hash of your API Secret,
        // formatted as a hex string (though base64 is supported too)
        private string SigningHash => WebEncoders.Base64UrlEncode(
            System.Security.Cryptography.SHA256.HashData(
                Encoding.UTF8.GetBytes(_nmbrApiSecret)
            )
        );

        [HttpPost]
        [Route("sign_nmbr_request")]
        public IActionResult SignNmbrRequest([FromBody] JObject payload)
        {
            // Your app should authenticate the user and
            // ensure they are authorized to administer payroll

            // Convert the JObject payload to a dictionary
            var payloadDictionary = payload.ToObject<Dictionary<string, object>>();

            // Create a security key using the API secret
            var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_nmbrApiSecret));

            // Create signing credentials
            var signingCredentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);

            // Create a JWT header with the signing credentials
            var header = new JwtHeader(signingCredentials);

            // Create a JWT payload from the payload dictionary
            var jwtPayload = new JwtPayload(payloadDictionary);

            // Create the JWT token
            var token = new JwtSecurityToken(header, jwtPayload);

            // Write the token to a string
            var tokenHandler = new JwtSecurityTokenHandler();
            var signedToken = tokenHandler.WriteToken(token);

            // Return the signed token as plain text
            return Content(signedToken, "text/plain");
        }
    }
}