A nonce is a random token that is generated and stored in Withings server with 30 minutes of validity.

As a partner, you will use this nonce token in the API services that require a signature so that Withings can check that the nonce token is still valid and was never used before. The usage of a nonce token prevents your service calls from replay attacks.

Because this service is an Device Management service, Withings checks your authorized access using your client_id and your secret based signature.

To generate the signature please follow these steps:

• Sort the following parameters alphabetically:
  • action
  • client_id
  • timestamp
• Generate a string by concatenating values separated by a comma. The string should look like: value1,value2,value3.
• Apply a hmac hashing function on the string using the algorithm sha256 and your partner client_secret (available in your Withings partner dashboard) as a secret key.
• Add the hash string in the parameters under the key signature

{
  "body": {
    "nonce": "aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d"
  }
}