Signature algorithm: HMAC-SHA1

Procedure

1. Prepare an active Alibaba Cloud AccessKey pair.

   To generate a signature for an HTTP request, use an AccessKey pair that consists of an AccessKey ID and an AccessKey secret.

   Note

   You can use an existing AccessKey pair or create a new one. Ensure the AccessKey pair is active.

2. Generate the signature string for the request.

   The signature string for an HTTP request is generated from its method, headers, and body.

   SignString = VERB + "\n"
                + CONTENT-MD5 + "\n"
                + CONTENT-TYPE + "\n"
                + DATE + "\n"
                + CanonicalizedHeaders + "\n"
                + CanonicalizedResource

   In the signature string, \n is a line break escape character and + is the string concatenation operator. The other parts are defined in the following table.

   Name	Description	Example
   VERB	The HTTP request method.	PUT, GET, POST
   CONTENT-MD5	The MD5 hash of the request body. Note The MD5 hash must be a string of uppercase letters and digits.	0B9BE351E56C90FED853B32524253E8B
   CONTENT-TYPE	The type of the request body.	application/json
   DATE	The standard timestamp header in the HTTP request. Note The timestamp must follow the RFC 1123 format and use Greenwich Mean Time (GMT).	Mon, 3 Jan 2010 08:33:47 GMT
   CanonicalizedHeaders	A string constructed from custom request headers that start with the x-cms or x-acs prefix.	x-cms-api-version:0.1.0 x-cms-signature
   CanonicalizedResource	A string constructed from the requested resource.	/event/custom/upload

   The `CanonicalizedHeaders` and `CanonicalizedResource` strings are constructed as follows:

   • CanonicalizedHeaders

     1. Convert the names of all HTTP request headers that start with the x-cms or x-acs prefix to lowercase.

     2. Sort all custom CMS and ACS request headers in ascending lexicographical order.

     3. Remove any spaces from either side of the separator between the request header and the content.

     4. Join the processed headers and their values with the \n separator to create the final `CanonicalizedHeaders` string.

   • CanonicalizedResource

     1. Set `CanonicalizedResource` to an empty string ("").

     2. Add the URI of the resource to `CanonicalizedResource`, such as /event/custom/upload.

     3. If the request includes a query string (QUERY_STRING), append a ? and the query string to the end of the `CanonicalizedResource` string.

        The QUERY_STRING is a string of request parameters from the URI, sorted in lexicographical order. In this string, parameter names and values are separated by an = sign. The parameters are sorted by name in ascending lexicographical order, and then the resulting pairs are concatenated with an & symbol. The formula is as follows:

        QUERY_STRING = "KEY1=VALUE1" + "&" + "KEY2=VALUE2"

3. Generate the digital signature for the request.

   The formula for the digital signature is as follows:

   Signature=base16(hmac-sha1(UTF8-Encoding-Of(SignString), AccessKeySecret))

   Example signature:

   SignString="POST" + "\n"
   +"0B9BE351E56C90FED853B32524253E8B" + "\n"
   +"application/json" + "\n"
   +"Tue, 11 Dec 2018 21:05:51 +0800" + "\n"
   +"x-cms-api-version:1.0" + "\n"
   +"x-cms-ip:127.0.0.1" + "\n"
   +"x-cms-signature:hmac-sha1" + "\n"
   +"/metric/custom/upload"
   accesskey="testkey"
   accessSecret="testsecret" // The signature key.

   Result:

   1DC19ED63F755ACDE203614C8A1157EB1097E922