Advanced: API-key Gated Data

Certain use cases require access to API endpoints protected by API keys. Given that SEDA is an open protocol, using API keys directly in a Data Request would expose them to the public, which is generally undesirable. To address this issue, SEDA utilizes Data Proxies. These proxies act as intermediaries between the API-key-protected endpoint and the overlay network, allowing only eligible Overlay Nodes to access the proxy. This ensures that unauthorized parties cannot access the API, securely exposing the API-key-protected endpoint without revealing the key.

For more information about Data Proxies and how to set one up, see Operating a Data Proxy.

In this walkthrough, we assume that a Data Proxy is already set up, either by you or a Data Provider of your choice.

Calling a Data Proxy Node with proxy_http_fetch is similar to using http_fetch, with a key difference in how the Overlay Node handles the request:

1. It attaches a proof header to the request (x-seda-proof), which includes information about the eligibility of the Overlay Node.

2. It verifies the validity of the Data Proxy's signature.

3. It adds the public key to the Overlay Node’s result, which is included in the tally phase.

4. (Optional) Verifies if the signature belongs to the given public key and throws an error if it is invalid. Note: As a security measure, you should verify the signatures during the tally phase. This is because the tally phase is a deterministic environment that all Chain Validators run, ensuring the data has not been tampered with. Verification during execution does not guarantee against a rogue Overlay Node submitting an incorrect signature.

Let's see how we can use proxy_http_fetch:

#[oracle_program]
impl PriceFeed {
    fn execute() {
        // proxyHttpFetch accepts the same arguments as http_fetch
        // The second argument is a public key; if set to None, the overlay node does not validate the signature
        let response = proxy_http_fetch(
            "https://my-data-proxy.com",
            None,
            Some(HttpFetchOptions {
                method: HttpFetchMethod::Get,
                headers: Default::default(),
                body: None,
            }),
        );

        // Call the endpoint and check if the signature is from the given public key
        let response = proxy_http_fetch(
            "https://my-data-proxy.com",
            Some("02a13c5e5dd02309d9c6395ebf6b79a389077a8ae04153bd07cd66f9743310d7be".to_string()),
            Some(HttpFetchOptions {
                method: HttpFetchMethod::Get,
                headers: Default::default(),
                body: None,
            }),
        );

        if !response.is_ok() {
            Process::error("Could not fetch API endpoint".as_bytes());
            return;
        }

        log!("{}", String::from_utf8(&response.bytes).unwrap());
    }

    fn tally() {
        panic!("Not implemented");
    }
}

proxy_http_fetch calls return two headers with every response. You can use these in your execution result, for example, if you want to verify the signatures during the tally phase:

let response = proxy_http_fetch(
    "https://my-data-proxy.com",
    None,
    Some(HttpFetchOptions {
        method: HttpFetchMethod::Get,
        headers: Default::default(),
        body: None,
    }),
);

// Returns a hex-encoded signature (secp256k1 signature)
let signature = hex::decode(response.headers.get("x-seda-signature").unwrap()).unwrap();
// Hex-encoded public key
let public_key = hex::decode(response.headers.get("x-seda-publickey").unwrap()).unwrap();

let message = generate_proxy_http_signing_message("https://my-data-proxy.com".to_string(), HttpFetchMethod::Get, Bytes::default(), response.bytes.to_bytes());

// In the tally phase, we can then verify the signature:
let is_signature_valid = secp256k1_verify(&message, &signature, &public_key);

// Do something with is_signature_valid...

This setup ensures that you can safely call APIs requiring keys, leveraging Data Proxies for secure interaction.