Examples
Message Header
A signature is provided in every message header in order to verify that Amazon is the initiator of the API call. Here is a sample header:
Authorization: DTA1-HMAC-SHA256 SignedHeaders=content-type;x-amz-date;x-amz-customer-id;x-amz-dta- version;x-amz-request-id, Credential=69b2048d-8bf8-4c1c-b49d-e6114897a9a5/20140101, Signature=ced6826de92d2bdeed8f846f0bf508e8559e98e4b0199114b84c54174deb456c x-amz-request-id: 0A49CE4060975EAC x-amz-date: expiry-date="Wed, 1 Jan 2014 00:00:00 GMT", rule-id="1" x-amz-customer-id: 1704344 x-amz-dta-version: 1
Header Field Description Authorization This field is populated with the information needed to authenticate the request and consists of an HMAC style signature and the information to calculate it. This field breaks down as follows:
ALGORITHM SignedHeaders=SIGNEDHEADERS, Credential=CREDENTIALDATA, Signature=SIGNATURE
Where each of those breaks down into:
- ALGORITHM: Currently this is always DTA1-HMAC-SHA256. Which means to sign the message using the shared secret daily key using SHA256.
- SIGNEDHEADERS: A list of headers which have been signed. The header names are all first lower cased and then are sorted in byte order.
- CREDENTIAL: This is of the form KEYID/DATE, where KEYID is the public identifier for the secret key used to sign. DATE is the date of the full time presented in x-amz-date in UTC. Using this information we can calculate the secret daily key for the request. We do this by signing the Date string in format YYYYMMDD with the secret key. This secret daily key is then used for the rest of the signing.
-
SIGNATURE: The computed signature using the request path, query parameters, http method, signed headers and body.
The algorithm is the same as used in: http://docs.aws.amazon.com/general/latest/gr/sigv4-signed-request-examples.html with the
major differences that:
- the keys are only generated to the *day* level as the AIA system is a single service segmented by region, and thus secret keys are already unique to this level
- the signing key is the HMAC-256 of the secret and the amz_date header (none of the other region, service, etc. information is required)
- the header names and values must not be trimmed, lowered, or otherwise modified when creating the canonical headers
x-amz-request-id A unique message id x-amz-date The time the request was made. Best practice is to discard any messages outside of 30min time window x-amz-customer-id A directed customer id for the Amazon user x-amz-dta-version API version Account Linking
Here is a sample link request and response without the header (For more information on the fields, see the API and SDK Overview section above):
Request
{ "operation": "GetUserId", "infoField1": "williamf@example.com", "infoField2": "MyGameCharacter" }
Response
{ "response": "OK", "userId": "550e8400" }