Access Control

Updated: 2021-01-19

When an API requires a signature in its parameters, follow these steps to compute the signature:

Arrange the parameter names in alphabetical order (excluding the signature and uploaded file contents).
Using the sorted order, concatenate the parameter values into a single string, separating each value with a \n (ASCII code 10).
Use the client_secret as the key to create an HMAC-SHA1 hash of the concatenated string (if calling the Library File API, use the org_client_secret). Then, encode the resulting hash using base64.

The formula for the signature is:

base64-encode(hmac-sha1({string}, {client_secret}))

Example of Signature Calculation

Given the following secret key:

client_secret = lZltU72WrEFOsbmT2IxSWg

And the data needing a signature:

client_id = NGCr2q1Fwc2tBWPfOartag
fullpath = conference materials/2017-10-31.docx
dateline = 1490605129

Steps to Calculate the Signature:

Sort the Parameters: Arrange them in alphabetical order by parameter name:

client_id = NGCr2q1Fwc2tBWPfOartag
dateline = 1490605129
fullpath = conference materials/2017-10-31.docx

Concatenate the Parameter Values: Join the values into a string, separated by \n:
```
NGCr2q1Fwc2tBWPfOartag
1490605129
conference materials/2017-10-31.docx
```
Compute the Signature: Generate the HMAC-SHA1 hash of the concatenated string using client_secret and then encode the result in base64:
```
glL9RlCmaDA6udIGo2DADTgCZlI=
```

To assist with signature calculation, you can use the embedded tool below: