Signature Generation Rules

Obtain the key information for userId, appId, and appSecret. For details, see Get Development Keys. The appSecret is used to generate the signature. As critical information for communication data security, it must never be stored or used directly on the client side. All API calls must be relayed through your own server to the POLYV server to obtain response data.

Signature Generation Rules

The rules for generating sign are as follows:

1. Sort all request parameters (parameters with non-null values) in ascending order by key (parameter name) according to dictionary order (ASCII value).
2. Concatenate the parameter names and values into a string in the format: key1value1key2value2...keyNvalueN.
3. Prepend and append the appSecret to the concatenated string.
4. Compute the MD5 hash of the concatenated string using UTF-8 encoding, then convert the MD5 result to uppercase letters as the sign.

Notes:

• The appSecret is only appended to the beginning and end of the string; it does not participate in the key sorting.
• The appSecret is only required for signature calculation. Do not include the appSecret in the request parameters when sending the request.
• Parameters with null values must be excluded during string concatenation.
• The character set for signing must be UTF-8. If not specified, the platform's default character set may be used, leading to errors.

Example

1. The API for querying channel co-stream usage requires the following parameters:

channelIds：2477096,2272655
startDay：2022-05-20
endDay：2022-06-18
appId：g4rqgmmjuo
timestamp：1660270926732
page：null
size：null

2. After sorting the non-null parameters by parameter name in dictionary order, the sequence is:

appId：g4rqgmmjuo
channelIds：2477096,2272655
endDay：2022-06-18
startDay：2022-05-20
timestamp：1660270926732

3. The concatenated string in the above order is:

appIdg4rqgmmjuochannelIds2477096,2272655endDay2022-06-18startDay2022-05-20timestamp1660270926732

4. After prepending and appending the appSecret, the string becomes (in this example, the appSecret fsq2k5weced1h8vui657xtdva66whf0g is a dummy value):

fsq2k5weced1h8vui657xtdva66whf0gappIdg4rqgmmjuochannelIds2477096,2272655endDay2022-06-18startDay2022-05-20timestamp1660270926732fsq2k5weced1h8vui657xtdva66whf0g

5. Finally, compute the MD5 hash of the string and convert it to uppercase to obtain the sign value:

0D2BDA2FD04D93A2B8832B91FD973C4D

Note: If the signature calculated using this method fails the API signature verification, please provide the string from step 4, the MD5 sign value from step 5, and the requested API endpoint to the online customer service via the bottom-right corner for troubleshooting. We will resolve your issue promptly.

Other

SHA256 Signature Algorithm (Optional)

This platform also supports the SHA256 signature algorithm for signature calculation. The specific encryption method is as follows:

1. Specify the request parameter signatureMethod=SHA256. If this parameter is absent, MD5 is used by default.
2. Sort all request parameters (parameters with non-null values) in ascending order by key (parameter name) according to dictionary order (ASCII value).
3. Concatenate the parameter names and values into a string in the format: key1value1key2value2...keyNvalueN.
4. Prepend and append the appSecret to the concatenated string.
5. Compute the SHA256 hash of the concatenated string using UTF-8 encoding, then convert the SHA256 result to uppercase letters as the sign.

One-Time Request Validation Parameter (Optional)

Use the parameter signatureNonce=unique random number to prevent network replay attacks. For example: signatureNonce=584F3849-E5A0-4B59-98A5-2F373EFD0559.

For quick integration of basic code, download the relevant dependency source code. Click here to download the source code. After downloading, add it to your own source code project. The test cases include HttpUtil.java and LiveSignUtil.java in the downloaded file.

It is strongly recommended to use the Live Java SDK for API integration. The Live Java SDK provides unified encapsulation and optimization for API call logic, exception handling, data signing, and HTTP request thread pools.

package net.polyv.common;

import java.io.UnsupportedEncodingException;
import java.security.NoSuchAlgorithmException;
import java.util.HashMap;
import java.util.Map;

import org.junit.Test;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import net.polyv.util.LiveSignUtil;

/**
 * @author: thomas
 **/
public class LiveSignTest {
    
    private static final Logger log = LoggerFactory.getLogger(LiveSignTest.class);
    
    @Test
    public void buildSign() throws UnsupportedEncodingException, NoSuchAlgorithmException {
        String appId = "XXXXXXXX";
        String userId = "XXXXXXXX";
        String appSecret = "XXXXXXXXXXXXXXXXXXXXXXXX";
        
        long timestamp = System.currentTimeMillis();
        Map<String, String> paramMap = new HashMap<String, String>();
        // 公共参数
        paramMap.put("appId", appId);
        paramMap.put("timestamp", Long.toString(timestamp));
        // 业务参数
        paramMap.put("channelId", "2149813");
        
        // 一次性签名(可选参数)
        // paramMap.put("signatureNonce", UUID.randomUUID().toString());
        
        // MD5签名(默认)
        String sign = LiveSignUtil.getSign(paramMap, appSecret);
        
        // SHA256签名
        // paramMap.put("signatureMethod", "SHA256");
        // String sign = LiveSignUtil.getSHA256Sign(paramMap, appSecret);
        
        log.debug("生成签名：{}", sign);
        
    }
    
}