For each HTTPS protocol access request, Volcano Engine verifies the identity of the requester by using the access key (including Access Key ID and Secret Access Key) contained in the access signature information.

Obtain access keys

Accounts and authorized users can create access keys. The actions are as follows:

Log in to the Access Control Console using the main account or an IAM user with key management permissions.

In the left navigation bar, select Resource Management > Key Management.

View your account's access key list.

Each account can have up to 2 access keys at the same time.

If the number of access keys for the current account has not reached the limit, you can click Create access key to create a new access key. After creation is complete, click View AccessKey details to view the new access key information.

Create a normalization request

Before signing, the request must be normalized to ensure that the signature calculation process is unambiguous. The main steps and pseudocode are as follows:

Parameter	Description
HTTPRequestMethod	HTTP request method, for example, POST.
CanonicalURI	Normalized URI. If the URI is empty, use/As an absolute path.
CanonicalQueryString	Normalized query string. Query string normalization process: URL encode (UrlEncode) each query string parameter name and parameter value. Strictly sort parameter names in ASCII byte order. Use the sorted parameter names and parameter values=Connect; pair parameters according to the sorting results&Connect. CanonicalQueryString = "Action=ListUsers&Version=2018-01-01"
CanonicalHeaders	Header after normalization. The pseudocode is as follows: CanonicalHeaders = CanonicalHeadersEntry0 + CanonicalHeadersEntry1 + ... + CanonicalHeadersEntryN CanonicalHeadersEntry = Lowercase(HeaderName) + ':' + Trimall(HeaderValue) + '\n' Lowercase converts the entire header name to lowercase, and Trimall removes extra spaces from the beginning and end of the header value. warning A \n line break needs to be added at the end. The order of headers is determined by the ASCII sorting of the lowercase form of headerName.
SignedHeaders	Name of the Header involved in signing. The signature header must be included in the list of normalized header names to specify which headers participate in signature calculation, thereby ignoring any additional headers added to the request by the proxy. If both the host and x-date headers are present, they must be added to the list of normalized header names. Pseudocode is as follows: SignedHeaders = Lowercase(HeaderName0) + ';' + Lowercase(HeaderName1) + ";" + ... + Lowercase(HeaderNameN)
RequestPayload	Complete body of the request. URL encoding (using the same method as RFC3986) for each Query String parameter name and parameter value The GET method must include all parameters, such as the hash algorithm, credential, signature date, and signature header. Parameter names are strictly sorted in ASCII byte order. Use the sorted parameter names and parameter values=Connect; match parameters according to the sorting results&Connect.

Create a signature string

The signature string primarily consists of the request and the metadata information of the canonical request, and is formed by concatenating the signature algorithm, request date, credential, and the hash value of the canonical request. The pseudocode is as follows:

The field explanations are as follows.

Parameter	Description
Algorithm	Signature algorithm. Currently, Volcano Engine only supports the HMAC-SHA256 signature algorithm.
RequestDate	Request UTC time. Please use the YYYYMMDD'T'HHMMSS'Z' format.
CredentialScope	Voucher scope. The format is YYYYMMDD/region/service/request.
CanonicalRequest	Pre-order normalization request result.

Calculate a signature key

Before calculating the signature, first derive the Signing Key from the Secret Access Key, rather than using the Secret Access Key directly. Specific calculation process is as follows:

kSecret = *Your Secret Access Key*
kDate = HMAC(kSecret, Date)
kRegion = HMAC(kDate, Region)
kService = HMAC(kRegion, Service)
kSigning = HMAC(kService, "request")

Calculate a signature

Signature = HexEncode(HMAC(kSigning, StringToSign))

Build a header.

Authorization: HMAC-SHA256 Credential={AccessKeyId}/{CredentialScope}, SignedHeaders={SignedHeaders}, Signature={Signature}

Signature examples and SDK

Signature examples

A pseudocode example of the signature process is provided above to help you understand how the signature is calculated. We have provided you with the signing process demo for your reference.

Additionally, we recommend using the SDK for signature generation and API calls. If you still need to implement signature calculation yourself, we also provide language-specific signature code for your reference.

SDK reference

Volcano Engine's OpenAPI provides SDKs for Java, Golang, PHP, Python, Node.js, and many other languages. You can use the SDK to call the product's OpenAPI, or you can use only the signature method in the SDK to avoid having to implement signature generation yourself. For details, refer to SDK Overview.

Container Registry