Authentication

Create credentials under Console > Developers to call InnoPaaS public APIs.

Choose an auth method using the rules below and follow the matching request example. Header fields and their constraints are defined in Request header contract.

Choose an auth method

Each request uses exactly one auth method. For regular API calls, API Key is recommended.

API Key auth

Create API KEY and API SECRET under Console > Developers. Put API KEY in Authorization; API SECRET is not used by this method and is never sent with requests. For the Console steps, see Create API keys.

curl --request POST '<API_URL>' \
  --header 'Content-Type: application/json;charset=utf-8' \
  --header 'Authorization: Bearer <API_KEY>' \
  --data-raw '<BUSINESS_JSON>'

Replace <API_URL>, <API_KEY>, and <BUSINESS_JSON> with real values before calling. Bearer and the key must be separated by exactly one space. Do not send AppID, Nonce, CurTime, or CheckSum with this method.

Request header contract

API Key auth

CheckSum auth

Do not send Authorization. All four headers below are required:

CheckSum signature auth

CheckSum = SHA1(API_SECRET + Nonce + CurTime).toUpperCase()

Concatenate the three parts in order with no separators, compute SHA1 over UTF-8 bytes, and uppercase the hex result. Nonce and CurTime must exactly match the request headers. API SECRET is used only for local computation and is never sent.

curl --request POST '<API_URL>' \
  --header 'Content-Type: application/json;charset=utf-8' \
  --header 'AppID: <API_KEY>' \
  --header 'Nonce: <NONCE>' \
  --header 'CurTime: <UNIX_TIMESTAMP_SECONDS>' \
  --header 'CheckSum: <CHECKSUM_UPPERCASE_HEX>' \
  --data-raw '<BUSINESS_JSON>'

Language examples

const crypto = require('crypto');
const nonce = crypto.randomBytes(16).toString('hex');
const curTime = Math.floor(Date.now() / 1000).toString();
const checkSum = crypto.createHash('sha1').update(apiSecret + nonce + curTime, 'utf8').digest('hex').toUpperCase();

Related

• Create API keys: create API KEY and API SECRET in the Console.

• Send your first voice notification: from activation to your first voice notification.

• API overview: browse all API endpoints and parameter contracts.

Examples use POST; the actual HTTP method depends on each endpoint's docs. Sample URLs, parameters, and responses are not a business contract.