RDS for PostgreSQL
RDS for PostgreSQL
Document
- Documentation
RDS for PostgreSQL API referenceCall methodsSignature mechanism
Copy page
Download PDFCall methods
Signature mechanism
Copy pageDownload PDFSignature mechanism
This topic introduces the signature mechanism for calling the RDS for PostgreSQL Open API. Signature encrypts request parameters to ensure requests are not tampered with during transmission.
Signature example
The Volcano Engine manual signature mechanism requires the requester to perform hash calculation for the request parameters, encrypt the request parameters, and send them with the API request to the server.
Getting the access key
The access key is the security credential for requesting the Volcano Engine OpenAPI. Refer to Access Key managementto retrieve the account's Access Key ID and Secret Access Key.
Constructing canonical request strings (CanonicalRequest)
Before applying a signature, it is important to canonicalize the request to avoid objections during the signature calculation process. Construct the canonical request string. The specific process and pseudocode are as follows:
tip
Hash refers to the SHA256 algorithm, HexEncode refers to hexadecimal encoding, and HMAC refers to HMAC_SHA256.
- HTTPRequestMethod
- HTTPRequestMethod refers to the HTTP request method, for example: GET or POST.
- CanonicalURI
- CanonicalURI refers to the normalized URI. If URI is empty, a forward slash ( / ) is used as the absolute path. The URI of most APIs in Volcano Engine is represented as ( / ).
- CanonicalQueryString
- Refers to the normalized Query String. For example:
-
- The general process for normalizing the Query String is as follows:
- URI-encode each querystring parameter name and parameter value.
- Sort parameter names strictly in ASCII byte order.
- Concatenate sorted parameter names and values with equal signs ( = ) and the parameter pairs with ampersands ( & ) according to the sorting result.
- CanonicalHeaders
- CanonicalHeaders refers to the canonicalized Header. The pseudo code is as follows:
-
- Among them,
-
tip
- Lowcase converts all Header names to lowercase.
- Trimall removes extra spaces before and after the header value.
- Be sure to add the \n newline character at the end.
- SignedHeaders
- Refers to the names of Headers involved in the signature. Signature Header is the list of names included in the normalized Headers, which indicates which Headers participate in signature calculation, so any additional Headers added by a proxy can be ignored. If Host and X-Date headers exist, they must be added. The pseudo code is as follows:
-
- RequestPayload
- Refers to the complete request body. Note the following:
- URI-encode (note: same as RFC3986 method) each querystring parameter name and parameter value.<|diff_marker|>
tip
The GET method needs to include all parameters such as hash algorithm, credential, signature date, and signature header.<|diff_marker|>
- Sort parameter names strictly in ASCII byte order.
- Concatenate sorted parameter names and values with equal signs ( = ) and the parameter pairs with ampersands ( & ) according to the sorting result.
Constructing the string to sign (StringToSign)
A string to sign contains the metadata information of the request and request canonicalization and concatenates the signature algorithm, request date, credential, and canonical request hash value. The pseudocode is as follows:
- Algorithm refers to the signature algorithm. Currently, Volcano Engine supports the HMAC-SHA256 signature algorithm only.
- RequestDate refers to the request UTC time in the following format: YYYYMMDD'T'HHMMSS'Z'.
- CredentialScope refers to credentials in the following format: YYYYMMDD/region/ service/request.
- CanonicalRequest refers to the canonical request result in the last section.
Calculating the signing key (kSigning)
Before signature calculation, you must first use the secret access key of the access key to derive a signing key (kSigning). Access Key is the security credential for requesting Volcano Engine OpenAPI. Refer to Access Key management to retrieve the account’s Access Key ID and Secret Access Key.
calculate the derived signing key, the calculation process and pseudocode are as follows:
tip
where Date is accurate to the day and is the same as the YYYYMMDD part in RequestDate.
Calculating the signature (Signature)
The pseudocode for calculating a signature is as follows:
Constructing the Authorization parameter
The Authorization parameter of the header is constructed in the following format:
Signature example
Last updated: 2025.11.17 21:01:21
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
