ElixirMpesa.Crypto (ElixirMpesa v0.2.0)

View Source

RSA encryption of the API key and session ID.

The M-Pesa OpenAPI authenticates in two stages, both using the same operation: take a value, encrypt it with the market's RSA public key using PKCS#1 v1.5 padding, and base64-encode the result.

  1. Encrypt the API key and exchange it at getSession for a session ID.
  2. Encrypt the session ID; the result is the bearer token for every other call.

ElixirMpesa.Session does both automatically. Use this module directly only when you are managing the session lifecycle yourself.

Padding

PKCS#1 v1.5 is what Vodacom's API requires. It is not this library's choice, and OAEP is not an option — the server will reject it.

Summary

Functions

encrypt(public_key_b64, plaintext)

Encrypts plaintext with a base64-encoded DER public key.

Functions

encrypt(public_key_b64, plaintext)

@spec encrypt(String.t(), String.t()) ::
  {:ok, String.t()} | {:error, ElixirMpesa.Error.t()}

Encrypts plaintext with a base64-encoded DER public key.

Whitespace in the key is tolerated — keys copied out of the developer portal often carry stray newlines.

Examples

iex> {:ok, ciphertext} = ElixirMpesa.Crypto.encrypt(ElixirMpesaTest.Fixtures.public_key(), "secret")
iex> byte_size(Base.decode64!(ciphertext))
512

iex> {:error, error} = ElixirMpesa.Crypto.encrypt("not-a-key", "secret")
iex> {error.reason, error.category}
{:invalid_public_key, :crypto}