Authenticating Rest Requests - Amazon Product Advertising API Developer's Manual

Product Advertising API Developer Guide
2 You calculate a keyed-hash message authentication code (HMAC-SHA) signature using
your Secret Access Key (for information about HMAC, go to
http://www.faqs.org/rfcs/rfc2104.html)
3 You include the signature and your Access Key ID in the request, and then send the request
to AWS.
AWS performs the next three tasks.
Process for Authentication: Tasks AWS Performs
Product Advertising API uses the Access Key ID to look up your Secret Access Key.
Product Advertising API generates a signature from the request data and the Secret Access
Key using the same algorithm you used to calculate the signature you sent in the request.
If the signature generated by AWS matches the one you sent in the request, the request is
considered authentic. If the comparison fails, the request is discarded, and AWS returns an
error response.

Authenticating REST Requests

This section describes how to create a signature. The Product Advertising API only supports Signature
Version 2.
To create the signature
1. Create the canonicalized query string that you need later in this procedure:
a. Sort the UTF-8 query string components by parameter name with natural byte ordering.
The parameters can come from the GET URI or from the POST body (when Content-Type is
application/x-www-form-urlencoded ).
b. URL encode the parameter name and values according to the following rules:
• Do not URL encode any of the unreserved characters that RFC 3986 defines.
Request Authentication
API Version 2011-08-01
57