Signature Statement

Since AZ needs to provide some open interfaces for third-party platforms, it requires data security issues of the interface, such as whether the data has been tampered with, whether the data is outdated, whether the data can be submitted repeatedly, and the frequency of access to the interface within a certain period of time. Among them, whether the data has been tampered with is most important.

1. Offline distribution of appkey and secretkey, for different calls, provide different appkey and secretkey.

2. Add timestamp, the value of which should be the unix timestamp (milliseconds) of the time when the request is sent, and the valid time of the data is calculated according to this value.

3. Add signature information for all data.

4. Add recvwindow (optional header validate-recvwindow, in milliseconds): the default is 5000; values larger than 60000 are treated as 60000.

   When the server receives a request, it compares validate-timestamp with the server time. If the difference (in either direction) is larger than the recvwindow, the request is rejected with HTTP 403.

   Network latency between your program and the AZ server varies, which is why the window is configurable. Start with the default 5000 and keep your system clock synchronized (NTP); raise the value only if requests are rejected because of network latency.

5. Add algorithms (optional header validate-algorithms). The signature is an HMAC; HmacSHA256 is the default and recommended. Supported: HmacSHA256, HmacSHA1, HmacSHA224, HmacSHA384, HmacSHA512, HmacMD5.

See Obtain Signature for how to build the signature and Common Signature Errors for troubleshooting.