In this section we'll walk you through the steps to sign a request. We'll use "dummy" AWS access identifiers that you can use as well. If you follow along these steps using these same identifiers, you will generate the same signature string that this example shows. This will help you to verify that your own code works correctly. After this detailed example, we'll also show you more streamlined examples for other requests.
![[Tip]](tip.png)
|
Tip |
|---|---|
|
If you aren't familiar with REST requests, read Anatomy of a REST Request before continuing with this example. |
For the detailed example we'll use a typical ItemLookup request:
http://webservices.amazon.com/onca/xml?Service=AWSECommerceServic e&AWSAccessKeyId=00000000000000000000&Operation=ItemLookup&ItemId =0679722769&ResponseGroup=ItemAttributes,Offers,Images,Reviews&Ve rsion=2009-01-06
Steps to Sign the Example Request
-
Enter the timestamp. For this example, we'll use GMT time of
2009-01-01T12:00:00Zhttp://webservices.amazon.com/onca/xml?Service=AWSECommerceServic e&AWSAccessKeyId=00000000000000000000&Operation=ItemLookup&ItemId =0679722769&ResponseGroup=ItemAttributes,Offers,Images,Reviews&Ve rsion=2009-01-06&Timestamp=2009-01-01T12:00:00Z
-
URL encode the request's comma (,) and colon (;) characters, so that they don't get misinterpreted. For more information about converting to RFC 3986 specifications, see documentation and code samples for your programming language.
http://webservices.amazon.com/onca/xml?Service=AWSECommerceServic e&AWSAccessKeyId=00000000000000000000&Operation=ItemLookup&ItemId =0679722769&ResponseGroup=ItemAttributes%2COffers%2CImages%2CRevi ews&Version=2009-01-06&Timestamp=2009-01-01T12%3A00%3A00Z
![[Important]](important.png)
Important Be sure that you do not double-escape any characters.
-
Split the parameter/value pairs and delete the ampersand characters (&) so that the example looks like the following:
Service=AWSECommerceService AWSAccessKeyId=00000000000000000000 Operation=ItemLookup ItemId=0679722769 ResponseGroup=ItemAttributes%2COffers%2CImages%2CReviews Version=2009-01-06 Timestamp=2009-01-01T12%3A00%3A00Z
-
Sort your parameter/value pairs by byte value (not alphabetically, lowercase parameters will be listed after uppercase ones).
AWSAccessKeyId=00000000000000000000 ItemId=0679722769 Operation=ItemLookup ResponseGroup=ItemAttributes%2COffers%2CImages%2CReviews Service=AWSECommerceService Timestamp=2009-01-01T12%3A00%3A00Z Version=2009-01-06
-
Rejoin the sorted parameter/value list with ampersands. The result is the canonical string that we'll sign:
AWSAccessKeyId=00000000000000000000&ItemId=0679722769&Operation=I temLookup&ResponseGroup=ItemAttributes%2COffers%2CImages%2CReview s&Service=AWSECommerceService&Timestamp=2009-01-01T12%3A00%3A00Z& Version=2009-01-06
-
Prepend the following three lines (with line breaks) before the canonical string:
GET webservices.amazon.com /onca/xml
-
The string to sign:
GET webservices.amazon.com /onca/xml AWSAccessKeyId=00000000000000000000&ItemId=0679722769&Operation=I temLookup&ResponseGroup=ItemAttributes%2COffers%2CImages%2CReview s&Service=AWSECommerceService&Timestamp=2009-01-01T12%3A00%3A00Z& Version=2009-01-06
-
Calculate an RFC 2104-compliant HMAC with the SHA256 hash algorithm using the string above with our "dummy" Secret Access Key:
1234567890. For more information about this step, see documentation and code samples for your programming language.Nace+U3Az4OhN7tISqgs1vdLBHBEijWcBeCqL5xN9xg=
-
URL encode the plus (+) and equal (=) characters in the signature:
Nace%2BU3Az4OhN7tISqgs1vdLBHBEijWcBeCqL5xN9xg%3D
-
Add the URL encoded signature to your request and the result is a properly-formatted signed request:
http://webservices.amazon.com/onca/xml?AWSAccessKeyId=00000000000 000000000&ItemId=0679722769&Operation=ItemLookup&ResponseGroup=It emAttributes%2COffers%2CImages%2CReviews&Service=AWSECommerceServ ice&Timestamp=2009-01-01T12%3A00%3A00Z&Version=2009-01-06&Signatu re=Nace%2BU3Az4OhN7tISqgs1vdLBHBEijWcBeCqL5xN9xg%3D