Amazon Product Advertising API - Signed requests

**youkai** · 13th July 2009, 10:42

Hi.

Until now, the Amazon Associate Web Service offers the possibility to retrieve product relevant data (like pictures) with kind of anonymous requests like this:

Qt Code:

Switch view

http://ecs.amazonaws.com/onca/xml?Service=AWSECommerceService
&Version=2008-04-07
&Operation=ItemSearch
&AWSAccessKeyId=FFFFFFFFFFFFFFFFFFFF
&ResponseGroup=Images
&SearchIndex=Music
&Artist=Beatsteaks
&Title=Joe

http://ecs.amazonaws.com/onca/xml?Service=AWSECommerceService
&Version=2008-04-07
&Operation=ItemSearch
&AWSAccessKeyId=FFFFFFFFFFFFFFFFFFFF
&ResponseGroup=Images
&SearchIndex=Music
&Artist=Beatsteaks
&Title=Joe

To copy to clipboard, switch view to plain text mode

But that won't be possible after 15th August 2009 anymore.

Requests have to be signed with your "Secret Access Key" - not only the "Access Key ID". They look like this:

Qt Code:

Switch view

http://ecs.amazonaws.com/onca/xml?Service=AWSECommerceService
&AWSAccessKeyId=FFFFFFFFFFFFFFFFFFFF
&Artist=Billy&Operation=ItemSearch
&ResponseGroup=Images
&SearchIndex=Music
&Timestamp=2009-07-13T09%3A21%3A27.000Z
&Title=Rusted
&Version=2009-03-31
&Signature=Xy%2BEafxOkFeWmxg3dGVTRWMsPPQCFWqDO7JMEQTIO00%3D

http://ecs.amazonaws.com/onca/xml?Service=AWSECommerceService
&AWSAccessKeyId=FFFFFFFFFFFFFFFFFFFF
&Artist=Billy&Operation=ItemSearch
&ResponseGroup=Images
&SearchIndex=Music
&Timestamp=2009-07-13T09%3A21%3A27.000Z
&Title=Rusted
&Version=2009-03-31
&Signature=Xy%2BEafxOkFeWmxg3dGVTRWMsPPQCFWqDO7JMEQTIO00%3D

To copy to clipboard, switch view to plain text mode

The signature field is problematic. Your application needs to compute this signature for each request based on the request fields and your secret key.

How is it possible to perform this signing wihout putting your secret key in your applications source code in plain text? I think this would be very dangerous.

Any ideas?

Bye

**wysota** · 13th July 2009, 10:49

You might provide an online service for your clients to sign requests - they send you the request, you sign it and send it back. You can protect your online service by using certificate based ssl access so that only authorized clients can use it.