API authentication with HMAC-SHA256

import crypto from "node:crypto";

const keyId = process.env.TD_KEY_ID!;
const secret = process.env.TD_SECRET!;

const method = "GET";
const path = "/v1/account";        // request path as sent to the server
const query = "";                  // sorted query string, empty if none
const timestamp = Math.floor(Date.now() / 1000).toString();
const nonce = crypto.randomUUID();
const body = "";
const bodyHash = crypto.createHash("sha256").update(body).digest("hex");

const stringToSign = [method, path, query, timestamp, nonce, bodyHash].join("\n");
const signature = crypto.createHmac("sha256", secret).update(stringToSign).digest("hex");

const res = await fetch("https://api.traveldistro.com" + path, {
  headers: {
    Authorization: `TD-HMAC-SHA256 KeyId=${keyId}, Signature=${signature}`,
    "X-TD-Timestamp": timestamp,
    "X-TD-Nonce": nonce,
  },
});