Skip to main content

Signature Instructions

Since AZ needs to provide some open interfaces for third-party platforms，therefore, the issue of data security needs to be considered. Such as whether the data has been tampered with, whether the data is outdated, whether the data can be submitted repeatedly, and the access frequency of the interface, and whether data has been tampered with is the most important issue.

  1. Please apply for appkey and secretkey in the user center first, each user's appkey and secretkey are different.

  2. Add timestamp, its value should be the unix timestamp (milliseconds) of the time when the request is sent, and the time of the data is calculated based on this value.

  3. Add signature, its value is obtained by a certain rule of signature algorithm.

  4. Add recvwindow (header validate-recvwindow, required): the validity window of the request, from 5000 to 60000 milliseconds.

    When the server receives a request, it compares validate-timestamp with the server time. If the difference (in either direction) is not smaller than validate-recvwindow, the request is rejected with AUTH_105.

    Network latency between your program and the AZ server varies, which is why the window is configurable. Start with 5000 and keep your system clock synchronized (NTP); raise the value only if you see AUTH_105 caused by network latency.

5、Added algorithm (signature method/algorithm), the user calculates the signature according to the protocol of the hash, and HmacSHA256 is recommended. For those protocols that are supported, see the table below.

HmacMD5、HmacSHA1、HmacSHA224、HmacSHA256(recommended)、HmacSHA384、HmacSHA512

See Signature generation for how to build the signature and Common Signature Errors for troubleshooting.