Signature mechanism-Real-Time Communication(RTC)-阿里云帮助中心

To ensure the security of API calls, Alibaba Cloud RTC authenticates each request with a signature. You must include this signature in every request, regardless of whether you use the HTTP or HTTPS protocol.

Note Alibaba Cloud RTC provides SDKs for multiple programming languages and supports third-party SDKs. You can use an SDK to skip the signature calculation step. To download an SDK, click Alibaba Cloud SDK Center.

RAM authorization

For enhanced account security, we recommend using the identity credentials of a Resource Access Management (RAM) user to call APIs. To use a RAM user to call an API, you must create an authorization policy and attach it to that user. For a list of authorizable resources and operations in RTC, see RAM resource authorization. For more information about AccessKey operations, see Obtain an AccessKey.

API signature

The RTC service authenticates every API request. You must include a signature in each request, whether you use HTTP or HTTPS.

RTC uses symmetric encryption with an AccessKey ID and an AccessKey secret to verify the identity of the request sender. An AccessKey is an identity credential issued to Alibaba Cloud accounts and RAM users, and is similar to a logon password. The AccessKey ID identifies the user. The AccessKey secret is the key used to encrypt the signature string, which the server then uses to verify the signature string. You must keep your AccessKey secret strictly confidential.

For example, consider the DeleteChannel API. Assume that the AccessKeyId is testid and the AccessKeySecret is testsecret. The request URL before it is signed is as follows:

https://rtc.aliyuncs.com/?Action=DeleteChannel
&AppId=a2h1****
&ChannelId=juz****
&Format=XML
&AccessKeyId=testid
&SignatureMethod=HMAC-SHA1
&SignatureNonce=3ee8c1b8-83d3-44af-a94f-4e0ad82fd6cf
&Version=2018-01-11
&SignatureVersion=1.0

The signature value calculated using testsecret& is as follows:

Y8c1u47r2gHn6scXqz92wklKws1=

Add the signature to the request URL as the Signature parameter. The final URL is as follows:

https://rtc.aliyuncs.com/?Action=DeleteChannel
&AppId=a2h1****
&ChannelId=juz****
&Format=XML
&AccessKeyId=testid
&SignatureMethod=HMAC-SHA1
&SignatureNonce=3ee8c1b8-83d3-44af-a94f-4e0ad82fd6cf
&Version=2018-01-11
&SignatureVersion=1.0
&Signature=Y8c1u47r2gHn6scXqz92wklKws1=

Alibaba Cloud provides sample code for signing requests in multiple programming languages.