---
title: Go language demo
slug: ki/go-language-demo
description: This document provides a Go implementation of the HMAC-SHA256 authentication algorithm. It includes functions for generating SHA256 hashes and HMAC-SHA256 signatures. Learn how to build a canonical request string, sign it, and generate an authorization he
docTags: 
createdAt: 2023-06-30T04:24:24.081Z
---

```go
package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "time"
)

func sha256hex(s string) string {
    b := sha256.Sum256([]byte(s))
    return hex.EncodeToString(b[:])
}

func hmacsha256(s, key string) string {
    hashed := hmac.New(sha256.New, []byte(key))
    hashed.Write([]byte(s))
    return string(hashed.Sum(nil))
}

func main() {
    accessKey := "AKIDz8krbsJ5yKBZQpn74WFkmLPx3*******"
    secretKey := "Gu5t9xGARNpq86cd98joQYCN3*******"
    host := "api-testing.klavi.ai"
    algorithm := "K1-HMAC-SHA256"
    service := "cbms"
    
    region := "ap-brazil"
    var timestamp int64 = time.Now().Unix()

    // step 1: build canonical request string
    // httpRequestMethod := "POST"
    // canonicalURI := "/"
    httpRequestMethod := "GET"
    canonicalURI := "/link/external/v2/getInstitutionList"
    canonicalQueryString := ""
    // canonicalHeaders := "content-type:application/json; charset=utf-8\n" + "host:" + host + "\n"
    canonicalHeaders := "content-type:application/x-www-form-urlencoded\n" + "host:" + host + "\n"
    signedHeaders := "content-type;host"
    payload := ""
    hashedRequestPayload := sha256hex(payload)
    canonicalRequest := fmt.Sprintf("%s\n%s\n%s\n%s\n%s\n%s",
        httpRequestMethod,
        canonicalURI,
        canonicalQueryString,
        canonicalHeaders,
        signedHeaders,
        hashedRequestPayload)
    fmt.Printf("canonicalRequest: %s\n\n",canonicalRequest)

    // step 2: build string to sign
    date := time.Unix(timestamp, 0).UTC().Format("2006-01-02")
    credentialScope := fmt.Sprintf("%s/%s/k1_request", date, service)
    hashedCanonicalRequest := sha256hex(canonicalRequest)
    string2sign := fmt.Sprintf("%s\n%d\n%s\n%s",
        algorithm,
        timestamp,
        credentialScope,
        hashedCanonicalRequest)
    fmt.Printf("string2sign: %s\n",string2sign)

    // step 3: sign string
    secretDate := hmacsha256(date, "K1"+secretKey)
    secretService := hmacsha256(service, secretDate)
    secretSigning := hmacsha256("k1_request", secretService)
    signature := hex.EncodeToString([]byte(hmacsha256(string2sign, secretSigning)))
    fmt.Printf("signature: %s\n\n",signature)

    // step 4: build authorization
    authorization := fmt.Sprintf("%s Credential=%s/%s, SignedHeaders=%s, Signature=%s",
        algorithm,
        accessKey,
        credentialScope,
        signedHeaders,
        signature)
    fmt.Printf("authorization: %s\n\n",authorization)

    // GET
    getCurl := fmt.Sprintf(`curl -s -L -X GET http://%s%s \
    -H 'Authorization: %s'\
    -H 'Content-type: application/x-www-form-urlencoded' \
    -H 'Host: %s'\
    -H 'X-Timestamp: %d' \
    -H 'X-Region: %s'`,host,canonicalURI,authorization,host,timestamp,region)
    fmt.Println(getCurl)

    // POST
    //postCurl := fmt.Sprintf(`curl -X POST https://%s\
    //-H "Authorization: %s"\
    //-H "Content-Type: application/json; charset=utf-8"\
    //-H "Host: %s"\
    //-H "X-Timestamp: %d"\
    //-H "X-Region: %s"\
    //-d '%s'`, host, authorization, host, timestamp, region, payload)
    //fmt.Println(postCurl)
}
```

:::hint{type="info"}
💡 **Note: ** 

**The GET method has been implemented in the code, and the commented code is the POST method.**
:::