Request signatures

Step 1: Assemble the string-to-sign

Concatenate the following fields, separated by newline characters (\n), into a single UTF-8 string:

HTTP_METHOD + "\n"
+ "\n"
+ CONTENT-TYPE + "\n"
+ DATE + "\n"
+ "x-mq-version:" + MQVersion + "\n"
+ CanonicalizedResource

The following table describes each field:

Example string-to-sign for a consume request:

POST

text/xml; charset=utf-8
Thu, 07 Mar 2012 18:49:58 GMT
x-mq-version:2015-06-06
/topics/abc/messages?consumer=GID_abc

Step 2: Compute the HMAC-SHA1 hash

Apply the HMAC-SHA1 algorithm (RFC 2104) to the string-to-sign, using your AccessKey secret as the signing key.

Step 3: Base64-encode the result

Base64-encode the binary HMAC-SHA1 output to produce the final signature string.

The complete formula:

Signature = base64(hmac-sha1(AccessKeySecret, StringToSign))

Function reference

Python

import hmac
import hashlib
import base64
import os
from email.utils import formatdate

# Obtain credentials from environment variables.
access_key_id = os.environ["MQ_ACCESS_KEY_ID"]
access_key_secret = os.environ["MQ_ACCESS_KEY_SECRET"]

# Request parameters
http_method = "POST"
content_type = "text/xml; charset=utf-8"
date = formatdate(usegmt=True)  # RFC 2616 format, e.g. "Thu, 07 Mar 2012 18:49:58 GMT"
mq_version = "2015-06-06"
canonicalized_resource = "/topics/abc/messages?consumer=GID_abc"

# Step 1: Assemble the string-to-sign.
string_to_sign = (
    http_method + "\n"
    + "\n"
    + content_type + "\n"
    + date + "\n"
    + "x-mq-version:" + mq_version + "\n"
    + canonicalized_resource
)

# Step 2-3: Compute HMAC-SHA1 and Base64-encode.
signature = base64.b64encode(
    hmac.new(
        access_key_secret.encode("utf-8"),
        string_to_sign.encode("utf-8"),
        hashlib.sha1,
    ).digest()
).decode("utf-8")

# Build the Authorization header.
authorization = f"MQ {access_key_id}:{signature}"
print(authorization)

Java

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.time.ZoneOffset;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import java.util.Base64;
import java.util.Locale;

public class MqSignature {
    public static void main(String[] args) throws Exception {
        // Obtain credentials from environment variables.
        String accessKeyId = System.getenv("MQ_ACCESS_KEY_ID");
        String accessKeySecret = System.getenv("MQ_ACCESS_KEY_SECRET");

        // Request parameters
        String httpMethod = "POST";
        String contentType = "text/xml; charset=utf-8";
        String date = DateTimeFormatter
                .ofPattern("EEE, dd MMM yyyy HH:mm:ss 'GMT'", Locale.US)
                .format(ZonedDateTime.now(ZoneOffset.UTC));
        String mqVersion = "2015-06-06";
        String canonicalizedResource = "/topics/abc/messages?consumer=GID_abc";

        // Step 1: Assemble the string-to-sign.
        String stringToSign = httpMethod + "\n"
                + "\n"
                + contentType + "\n"
                + date + "\n"
                + "x-mq-version:" + mqVersion + "\n"
                + canonicalizedResource;

        // Step 2-3: Compute HMAC-SHA1 and Base64-encode.
        Mac mac = Mac.getInstance("HmacSHA1");
        mac.init(new SecretKeySpec(
                accessKeySecret.getBytes(StandardCharsets.UTF_8), "HmacSHA1"));
        byte[] rawSignature = mac.doFinal(
                stringToSign.getBytes(StandardCharsets.UTF_8));
        String signature = Base64.getEncoder().encodeToString(rawSignature);

        // Build the Authorization header.
        String authorization = "MQ " + accessKeyId + ":" + signature;
        System.out.println(authorization);
    }
}

Go

package main

import (
	"crypto/hmac"
	"crypto/sha1"
	"encoding/base64"
	"fmt"
	"os"
	"time"
)

func main() {
	// Obtain credentials from environment variables.
	accessKeyID := os.Getenv("MQ_ACCESS_KEY_ID")
	accessKeySecret := os.Getenv("MQ_ACCESS_KEY_SECRET")

	// Request parameters
	httpMethod := "POST"
	contentType := "text/xml; charset=utf-8"
	date := time.Now().UTC().Format("Mon, 02 Jan 2006 15:04:05 GMT")
	mqVersion := "2015-06-06"
	canonicalizedResource := "/topics/abc/messages?consumer=GID_abc"

	// Step 1: Assemble the string-to-sign.
	stringToSign := httpMethod + "\n" +
		"\n" +
		contentType + "\n" +
		date + "\n" +
		"x-mq-version:" + mqVersion + "\n" +
		canonicalizedResource

	// Step 2-3: Compute HMAC-SHA1 and Base64-encode.
	mac := hmac.New(sha1.New, []byte(accessKeySecret))
	mac.Write([]byte(stringToSign))
	signature := base64.StdEncoding.EncodeToString(mac.Sum(nil))

	// Build the Authorization header.
	authorization := fmt.Sprintf("MQ %s:%s", accessKeyID, signature)
	fmt.Println(authorization)
}

Node.js

const crypto = require("crypto");

// Obtain credentials from environment variables.
const accessKeyId = process.env.MQ_ACCESS_KEY_ID;
const accessKeySecret = process.env.MQ_ACCESS_KEY_SECRET;

// Request parameters
const httpMethod = "POST";
const contentType = "text/xml; charset=utf-8";
const date = new Date().toUTCString(); // RFC 2616 format
const mqVersion = "2015-06-06";
const canonicalizedResource = "/topics/abc/messages?consumer=GID_abc";

// Step 1: Assemble the string-to-sign.
const stringToSign = [
  httpMethod,
  "",
  contentType,
  date,
  `x-mq-version:${mqVersion}`,
  canonicalizedResource,
].join("\n");

// Step 2-3: Compute HMAC-SHA1 and Base64-encode.
const signature = crypto
  .createHmac("sha1", accessKeySecret)
  .update(stringToSign, "utf-8")
  .digest("base64");

// Build the Authorization header.
const authorization = `MQ ${accessKeyId}:${signature}`;
console.log(authorization);