Authentication
Signature certification access
The Access Key and request signature mechanism are uniformly adopted for all API security authentication. Access Key consists of an Access Key ID and a Secret Access Key, both of which are strings. For each HTTP request, use the algorithm described below to generate a authentication string. Submit the certification string in the Authorization header. The server verifies the correctness of the authentication string based on the generation algorithm. The certification string format is bce-auth-v{version}/{accessKeyId}/{timestamp}/{expirationPeriodInSeconds}/{signedHeaders}/{signature}.
- The version is a positive integer.
- The timestamp refers to the UTC time when the signature is created.
- The expirationPeriodInSeconds specifies the duration during which the signature remains valid.
- signedHeaders is the list of headers involved in the signature algorithm. Separate headers with semicolons (;), such as host; x-bce-date. The list is sorted in lexicographical order. (This API signature only contains two headers of host and x-bce-date) Signature is a 256-bit signature represented by 64-character lowercase hex digest.
When Baidu AI Cloud receives a user's request, the system uses the same SK and certification mechanism to generate a certification string. This string is then compared with the one included in the user's request. If the two match, the system confirms the user has the required permissions and proceeds with the operation. If they differ, the system cancels the operation and returns an error code.
For detailed information on the authentication mechanism, please refer to Authentication. You can also refer to the video How to Call APIs for more information.
Temporary authorized access
BOS can realize temporary authorized access for third parties through the STS mechanism. Please refer to the document Temporary Authorized Access.