2. Request Signing

Signature Generation

1. Serialize the business request parameters in data to JSON.
2. Sort apiKey, data (the serialized JSON), and timestamp in ascending, case-insensitive lexicographic order, then concatenate them.
3. Generate signature by applying HmacSHA256 to the concatenated string using apiSecret as the key.

Complete request example:

Request URL:

POST /OpenApi/V1/Sku/Sku/create?signature=xxx

Example API secret: example-api-secret

Request body:

{
    "apiKey": "FK_xxxxxxxxxxxxxxx",
    "timestamp": "1704067200",
    "data": {
        "sku": "SKU123456",
        "skuName": "Product name"
    }
}

After sorting and concatenation:

FK_xxxxxxxxxxxxxxx{"sku":"SKU123456","skuName":"Product name"}1704067200

Generated signature:

1b3071729c62744ecbb6b36f8c09f88e2dffea863aeec67333a0d50528c3e62c

Note:

• The timestamp field is the request time as a 10-digit UNIX timestamp. The server rejects requests that are more than 5 minutes old.
• Pass signature as a URL query parameter. Send the remaining parameters in the POST body.
• Place all endpoint-specific request parameters described in this documentation, such as sku and skuName, inside the data object.

---