API Signature & Authentication Specification

1. Interface Signature Rules (sign)

2. Simplified Signature Rules for POST-JSON Request Interfaces
For requests with a JSON payload, the nested structure may cause inconsistent field ordering across different serialization libraries, leading to signature verification failures. To mitigate this issue, a simplified authentication scheme is provided.

Instead of signing the entire JSON body, the following top-level fields are introduced in the request body:

Signature Generation (Simplified Rule)
The signature is generated as follows:

Verification Flow

1.Extract appKey, requestTime, and sign from the JSON request body.
2.Compute the signature using the same algorithm with the stored appSecret.
3.Compare the computed signature with the provided sign value.
4.Validate that requestTime is within the acceptable time window (e.g., 5 minutes) to prevent replay attacks.