Docs

Code Pipeline

Methods of invocation

Signature mechanism

For each HTTPS protocol access request, system verifies the identity of the requester using the access keys in the access signature information, including Access Key ID and Secret Access Key.

Obtain access keys

Accounts and authorized users can create new access keys. The actions are as follows:

In the left navigation bar, select Resource management > Key management.

View the list of access keys for your account.

Each account can have up to 2 access keys at the same time.

If the current account has not reached the maximum number of access keys, you can click Create Key to create a new access key. After creation is complete, click View AccessKey details to view the new access key information.

Create a normalization request

tip

Hash refers to the SHA256 algorithm.

"HexEncode" refers to hexadecimal encoding.

CanonicalRequest = HTTPRequestMethod + '\n' + CanonicalURI + '\n' + CanonicalQueryString + '\n' + CanonicalHeaders + '\n' + SignedHeaders + '\n' + HexEncode(Hash(RequestPayload))​

Before signing, the request must be normalized to ensure that the signature calculation process is unambiguous. The main process and pseudocode are as follows:

field	Descriptions
HTTPRequestMethod	HTTP request methods, for example, POST.
CanonicalURI	Normalized URI. If the URI is empty, then use/As an absolute path.
CanonicalQueryString	The normalized QueryString. QueryString normalization process: URL encode (UrlEncode) each QueryString parameter name and parameter value. Strictly sort parameter names in ASCII byte order. Use the sorted parameter names and parameter values=Connect; match parameters according to the sorting results&Connect. CanonicalQueryString = "Action=ListPipelines&Version=2023-05-01"
CanonicalHeaders	The standardized header. The pseudocode is as follows: CanonicalHeaders = CanonicalHeadersEntry0 + CanonicalHeadersEntry1 + ... + CanonicalHeadersEntryN CanonicalHeadersEntry = Lowercase(HeaderName) + ':' + Trimall(HeaderValue) + '\n' Among them, Lowercase means converting all Header names to lowercase, while Trimall means removing any extra spaces from the beginning and end of the Header Value. warning Add a line break character at the end: `\n`. Headers are sorted by the ASCII values of headerName after converting to lowercase.
SignedHeaders	Header names included in the signature Headers to be signed must be included in the list of normalized header names to specify which headers are involved in the signature calculation, so that any additional headers added to the request by a proxy are ignored. If both host and x-date headers are present, add them to the list of normalized header names. The pseudocode is as follows: SignedHeaders = Lowercase(HeaderName0) + ';' + Lowercase(HeaderName1) + ";" + ... + Lowercase(HeaderNameN)
RequestPayload	The complete body of the request. URL encode (using the RFC3986 method) each QueryString parameter name and value. The GET method must include all parameters: hash algorithm, credential, signature date, and signature header. Strictly sort parameter names in ASCII byte order. Use the sorted parameter names and parameter values=Connect; pair the parameters according to the sorting result.&Connection.

Create a signature string

The signature string contains the request and the metadata of the normalized request, and is constructed by concatenating the signature algorithm, request date, credential, and normalized request hash value. The pseudocode is as follows:

StringToSign = Algorithm + '\n' + RequestDate + '\n' + CredentialScope + '\n' + HexEncode(Hash(CanonicalRequest))​

The field descriptions are as follows.

field	Descriptions
Algorithm	Signature algorithms. Currently, only supports the HMAC-SHA256 signature algorithm.
RequestDate	Request UTC time. Use the YYYYMMDD'T'HHMMSS'Z' format, for example: 20201103T104027Z.
CredentialScope	Scope of vouchers. The format is YYYYMMDD/region/service/request.
CanonicalRequest	The results of the preorder normalization request.

Calculate the signature key

Before calculating the signature, first derive a signing key (Signing Key) from the Secret Access Key, rather than using the Secret Access Key directly. The specific calculation process is as follows:

kSecret = *Your Secret Access Key*
kDate = HMAC(kSecret, Date)
kRegion = HMAC(kDate, Region)
kService = HMAC(kRegion, Service)
kSigning = HMAC(kService, "request")

Calculate a signature.

Signature = HexEncode(HMAC(kSigning, StringToSign))

Build a header.

tip

In expressions, use{}The content inside represents the intermediate result calculated above.

Authorization: HMAC-SHA256 Credential={AccessKeyId}/{CredentialScope}, SignedHeaders={SignedHeaders}, Signature={Signature}

Last updated: 2025.09.10 17:37:28