Docs

Volcano Engine Function as a Service

Call methods

Signature mechanism

For each access request, the Volcano Engine verifies the identity of the access requestor through the access key (including Access Key ID and Secret Access Key) in the access signature information.

Obtain access key

Accounts and users with permission can create access keys in the following operation:

Use the root user or an IAM user with key management permissions to log in to the Identity and Access Management console.

In the left navigation bar select Resource Management > Key Management.

View the list of access keys for your account.

Each account has a maximum of two access keys simultaneously.

If the current account does not have the maximum number of access keys, click Create key to create a new access key. After creating, click View AccessKey details to view the information of the new access key.

Create a normalization request

tip

Hash refers to the SHA256 algorithm.

HexEncode refers to changing to hexadecimal encoding.

Before signing, the request should be normalized so that the signature calculation process has no objections. The main process and pseudocode are as follows:

Field	Description
HTTPRequestMethod	HTTP request method, e.g. POST.
CanonicalURI	The normalized URI. If the URI is empty, then use/as an absolute path.
CanonicalQueryString	Normalized QueryString. The QueryString normalization process is as follows: URL Encode the parameter name and parameter value of each QueryString. Strict ordering of parameter names in ASCII byte order. Connect the parameter names and parameter values in the right order using=Connect the parameter pairs according to sorted results using&Connect. CanonicalQueryString = "Action=ListUsers&Version=2018-01-01"
CanonicalHeaders	Header after normalization. The pseudocode is as follows: CanonicalHeaders = CanonicalHeadersEntry0 + CanonicalHeadersEntry1 + ... + CanonicalHeadersEntryN CanonicalHeadersEntry = Lowercase(HeaderName) + ':' + Trimall(HeaderValue) + '\n' Among them, Lowercase means to convert all the names of the Header to lowercase, and Trimall means to remove the excess spaces before and after the value of the Header. warning You need to add line-changing characters: '\n' at the end. The order of the Header is ASCII sorted by the lowercase of the headerName.
SignedHeaders	The name of the Header participating in the signature. The signature Header should be included in the list of normalized Headers to indicate which Headers participate in the signature calculation, thus ignoring the additional Headers added by the proxy. If there are two Headers host and x-date, then they must be added to the list of normalized Header names. The pseudocode is as follows: SignedHeaders = Lowercase(HeaderName0) + ';' + Lowercase(HeaderName1) + ";" + ... + Lowercase(HeaderNameN)
RequestPayload	Complete request body. The URL encodes the parameter name and parameter value of each QueryString (the same as the RFC3986 method). Here, the GET method needs to include all parameters of hash algorithm, trust certificate, signature date, and signature Header, etc. Strict ordering of parameter names in ASCII byte order. Connect the parameter names and parameter values in the right order using=Connect the parameter pairs according to sorted results using&Connect.

Create signature string

The signature string mainly contains the metadata information of the request and the normalization request. It consists of the signature algorithm, the request date, the trust certificate, and the normalization request hash value connection. The pseudocode is as follows:

The field description is as follows.

Field	Description
Algorithm	The algorithm for signature. The current Volcano Engine only supports the HMAC-SHA256 signature algorithm.
RequestDate	Request UTC time. Please use YYYYMMDD T'HHMMSS'Z'format, e.g.: 20201103T104027Z.
CredentialScope	Scope of credentials. The format is YYYYMMDD/region/service/request.
CanonicalRequest	The result of a preorder normalization request.

Calculate signature key

Before calculating the signature, first derive the Signing Key from the Secret Access Key, rather than directly using the Secret Access Key. The specific calculation process is as follows:

kSecret = *Your Secret Access Key*
kDate = HMAC(kSecret, Date)
kRegion = HMAC(kDate, Region)
kService = HMAC(kRegion, Service)
kSigning = HMAC(kService, "request")

Calculate the signature.

Signature = HexEncode(HMAC(kSigning, StringToSign))

Build the Header.

tip

Use in the expression{}the content, representing the middle process calculated in the above.

Authorization: HMAC-SHA256 Credential={AccessKeyId}/{CredentialScope}, SignedHeaders={SignedHeaders}, Signature={Signature}

Sample code

The following is the Golang implementation of the signature mechanism. After signing, the veFaaS OpenAPI ListFunctions interface is called. For signature algorithms and examples implemented in Python, Java, NodeJS, PHP, and more, please refer to volcengine/volc-openapi-demos.

Last updated: 2025.06.30 11:48:53