Docs

Volcengine Managed Service for Prometheus

Calling method

Signature mechanism

Volcano Engine verifies the identity of each request initiator based on the access key, including the Access Key ID and Secret Access Key, in the signature information of each HTTPS request.

Getting a secret key

Accounts and authorized users can create an access key by performing the following steps:

Log in to the Identity and Access Management console as a root user or an IAM user who has access to the Access Key Management.

Select Access Key Management in the left navigation bar.

View the list of access keys for your account.

Each account can have up to 2 access keys.

Click Create Access Key to create a new access key. After the new key is created, click View AccessKey to see the details.

Creating a canonical request

tip

Hash refers to the SHA256 algorithm.

HexEncode refers to hexadecimal encoding.

Before applying a signature, the request needs to be canonicalized first. The following table contains the fields and pseudocodes used for canonicalization:

Field	Descriptions
HTTPRequestMethod	HTTP request method, e.g., POST.
CanonicalURI	Canonicalized URI. If the URI is empty, use / as the absolute path.
CanonicalQueryString	Canonicalized query string. The steps to canonicalize query strings: Each query parameter name and value needs to be converted using URL encoding (UrlEncode) Sort the parameter names in ASCII byte order. Connect each sorted parameter name and value with =, and connect the sorted parameter pairs with &. CanonicalQueryString = "Action=ListUsers&Version=2018-01-01"
CanonicalHeaders	Canonicalized header. The pseudocode is as follows: CanonicalHeaders = CanonicalHeadersEntry0 + CanonicalHeadersEntry1 + ... + CanonicalHeadersEntryN CanonicalHeadersEntry = Lowercase(HeaderName) + ':' + Trimall(HeaderValue) + '\n' In the above pseudocodes, Lowercase means converting the header names to lowercase, and Trimall means removing extra spaces before and after header values. warning A line break \\n is required at the end. The order of headers is sorted by lowercase ASCII characters of headerName.
SignedHeaders	The names of the headers involved in the signature. The headers involved in signature generation must be included during canonicalization, with the purpose of ignoring those headers added by proxies. The headers host and x-date, if exist, need to be included anyway. The pseudocode is as follows: SignedHeaders = Lowercase(HeaderName0) + ';' + Lowercase(HeaderName1) + ";" + ... + Lowercase(HeaderNameN)
RequestPayload	The complete request body. Each query parameter name and value needs to be converted using URL encoding (same as the RFC3986 method) For the GET method, all parameters, such as the hash algorithm, credential, signing date, and signed headers, must be included. Sort the parameter names in ASCII byte order. Connect each sorted parameter name and value with =, and connect the sorted parameter pairs with &.

Creating a signature string

A signature string is generally made up of a request and the related metadata. In detail, it includes a signature algorithm, request date, credential, and a hash value of the canonicalized request. The pseudocode is as follows:

The following table shows the fields used above.

Field	Descriptions
Algorithm	The signature algorithm. Currently, Volcano Engine only supports the HMAC-SHA256 signature algorithm.
RequestDate	Request UTC time. Please use the YYYYMMDD'T'HHMMSS'Z' format.
CredentialScope	Credential scope. The format is YYYYMMDD/region/service/request.
CanonicalRequest	The canonicalized request produced previously.

Calculating a signing key

A signing key needs to be calculated first by using the Secret Access Key before getting the signature. The calculation steps are shown below:

kSecret = *Your Secret Access Key*
kDate = HMAC(kSecret, Date)
kRegion = HMAC(kDate, Region)
kService = HMAC(kRegion, Service)
kSigning = HMAC(kService, "request")

Calculate the signature.

Signature = HexEncode(HMAC(kSigning, StringToSign))

Construct the headers.

tip

In the pseudocode,{}-enclosed content represents the intermediate results calculated in the preceding steps.

Authorization: HMAC-SHA256 Credential={AccessKeyId}/{CredentialScope}, SignedHeaders={SignedHeaders}, Signature={Signature}

Signature examples and SDKs

Signature examples

The preceding pseudocode examples help you understand how signatures are calculated. We also provide a Signature Process Demo for your reference.

In addition, we recommend using the SDK to generate signatures and make calls to APIs. If you prefer doing it by coding, see Coding for signature to find a reference to your coding language.

SDK reference

Volcano Engine OpenAPI provides SDKs in different languages, such as Java, Golang, PHP, Python, and Node.js. You can use the SDKs to call product OpenAPIs or use only the signature method provided by the SDKs to avoid manually coding the signature logic. For details, please refer to SDK Overview.

Last updated: 2026.07.10 11:12:04