KEY="your-key-id"
SECRET="your-secret"
METHOD="GET"
URLPATH="/predictions-service/api/account"
BODY=""

TS=$(( $(date +%s) * 1000 ))
SIG=$(printf '%s' "$TS$METHOD$URLPATH$BODY" | openssl dgst -sha256 -hmac "$SECRET" -binary | base64)

curl -X "$METHOD" "https://api.splashsports.com$URLPATH" \
  -H "SPLASH-ACCESS-KEY: $KEY" \
  -H "SPLASH-ACCESS-TIMESTAMP: $TS" \
  -H "SPLASH-ACCESS-SIGNATURE: $SIG"

import base64, hashlib, hmac, json, time
import requests

KEY = "your-key-id"
SECRET = "your-secret"
HOST = "https://api.splashsports.com"


def sign(secret, timestamp, method, path, body):
    message = (timestamp + method + path + body).encode("utf-8")
    digest = hmac.new(secret.encode("utf-8"), message, hashlib.sha256).digest()
    return base64.b64encode(digest).decode("ascii")


def request(method, path, payload=None):
    body = json.dumps(payload, separators=(",", ":")) if payload is not None else ""
    timestamp = str(int(time.time() * 1000))
    headers = {
        "Content-Type": "application/json",
        "SPLASH-ACCESS-KEY": KEY,
        "SPLASH-ACCESS-TIMESTAMP": timestamp,
        "SPLASH-ACCESS-SIGNATURE": sign(SECRET, timestamp, method, path, body),
    }
    return requests.request(method, HOST + path, headers=headers, data=body.encode("utf-8"))


response = request("GET", "/predictions-service/api/account")
print(response.status_code, response.json())

const options = {
  method: 'GET',
  headers: {
    'SPLASH-ACCESS-KEY': '<api-key>',
    'SPLASH-ACCESS-TIMESTAMP': '<api-key>',
    'SPLASH-ACCESS-SIGNATURE': '<api-key>'
  }
};

fetch('https://api.splashsports.com/predictions-service/api/account', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import { createHmac } from "node:crypto";

const KEY = "your-key-id";
const SECRET = "your-secret";
const HOST = "https://api.splashsports.com";

function sign(secret: string, timestamp: string, method: string, path: string, body: string): string {
  return createHmac("sha256", secret).update(timestamp + method + path + body, "utf8").digest("base64");
}

const method = "GET";
const path = "/predictions-service/api/account";
const body = "";
const timestamp = Date.now().toString();

const response = await fetch(HOST + path, {
  method,
  headers: {
    "SPLASH-ACCESS-KEY": KEY,
    "SPLASH-ACCESS-TIMESTAMP": timestamp,
    "SPLASH-ACCESS-SIGNATURE": sign(SECRET, timestamp, method, path, body),
  },
});
console.log(response.status, await response.json());

package main

import (
	"bytes"
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"fmt"
	"io"
	"net/http"
	"strconv"
	"time"
)

const (
	key    = "your-key-id"
	secret = "your-secret"
	host   = "https://api.splashsports.com"
)

func sign(secret, timestamp, method, path string, body []byte) string {
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(timestamp + method + path))
	mac.Write(body)
	return base64.StdEncoding.EncodeToString(mac.Sum(nil))
}

func main() {
	method := "GET"
	path := "/predictions-service/api/account"

	var body []byte // no body: the signature covers the empty string
	timestamp := strconv.FormatInt(time.Now().UnixMilli(), 10)

	req, err := http.NewRequest(method, host+path, bytes.NewReader(body))
	if err != nil {
		panic(err)
	}
	req.Header.Set("SPLASH-ACCESS-KEY", key)
	req.Header.Set("SPLASH-ACCESS-TIMESTAMP", timestamp)
	req.Header.Set("SPLASH-ACCESS-SIGNATURE", sign(secret, timestamp, method, path, body))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
	out, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.StatusCode, string(out))
}