robosats api in node/nuxt 3 app invalid token

[learntheropes]

I'm trying to integrate robosats api in a nuxt3 application but I always get:

{ bad_request: 'Robot token SHA256 was provided in the header. However it is not a valid 39 or 40 characters Base91 string.' }

if I include all the required headers props

Or

RoboSats API error: { bad_request: 'On the first request to a RoboSats coordinator, you must provide as well a valid public and encrypted private PGP keys' }

If I only include the token (that let me assume that the token is actually correct).

A typical token that I generate is:

tokenBase91 C&UKWOoRjZS+qIs?oI{3&]*x}#d@:&;2C!W+jy`| length 40

Here it's a minimal repo to reproduce: https://github.com/learntheropes/robosats-nuxt3

The most relevant part of my code, that tries to replicate what the frontend does in this official repo, is:

import * as openpgp from 'openpgp'
import { createHash, randomBytes } from 'crypto'
import baseX from 'base-x'

const base91 = baseX("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$%&()*+,./:;=?@[]^_`{|}~"
)

  const rawToken = randomBytes(32)
  const token = rawToken.toString('hex')
  const tokenHash = createHash('sha256').update(rawToken).digest()
  const tokenBase91 = base91.encode(tokenHash)
  const nostrPubKey = createHash('sha256').update(rawToken).digest('hex')
  
  const { privateKey, publicKey } = await openpgp.generateKey({
    type: 'rsa',
    rsaBits: 2048,
    userIDs: [{ name: 'Robot', email: 'robot@example.com' }],
    passphrase: token,
    format: 'armored'
  })

  function escapeHeaderContent(str) {
  return str.replace(/\r?\n/g, '\\n').replace(/[\x00-\x1F\x7F]/g, '')
}

  const armoredPublic = escapeHeaderContent(publicKey)
  const armoredPrivate = escapeHeaderContent(privateKey)

  const authorization = [
    `Token ${tokenBase91}`,
    `^| Public ${armoredPublic}`,
    `^| Private ${armoredPrivate}`,
    `^| Nostr ${nostrPubKey}`
  ].join(' ')

What could be the issue?

[KoalaSat]

This error

RoboSats API error: { bad_request: 'On the first request to a RoboSats coordinator, you must provide as well a valid public and encrypted private PGP keys' }

Means that you are not sending the PGP keys on headers with the first request of one specific robot to one specific coordinator (coordinators are totally independent from from each other and you should treat them like separate services)

This one

{ bad_request: 'Robot token SHA256 was provided in the header. However it is not a valid 39 or 40 characters Base91 string.' }

Means that you are sending somehow a wrongly formated robot token. You can find how tokens are created in client's code https://github.com/RoboSats/robosats/blob/main/frontend/src/utils/token.ts#L2

Just a heads up. We are planing to stop using PGP keys in favour of nostr pub keys for v0.8.0

robosats/robosats/middleware.py

Line 53 in a034f4a

request.META["NOSTR_PUBKEY"] = split_auth[3]