Setup Wizard

Account and Credentials

APPID

Formatted like app_xxx, it identifies which project is making the call and takes part in the signature.

APPSECRET

Formatted like sk_xxx, used only on the server to compute the signature, must never be sent to the frontend.

Signature Mechanism (HMAC-SHA256)

Endpoints that are Signature Required (auth) must include the common parameters on every request: app_id / timestamp / nonce / sign.

1. Take all parameters except sign (including app_id/timestamp/nonce and business parameters), filtering out empty values;
2. Sort by parameter name in ascending ASCII order;
3. Concatenate into key=value&key=value…;
4. Prepend the uppercase method, a newline, the request path and another newline to form the string to sign (the path includes the trailing slash and excludes the query string);
5. Use APPSECRET as the key to sign the whole string with HMAC-SHA256, and output the lowercase hex digest as sign.

timestamp is a Unix timestamp in seconds with a ±5 minute validity window; nonce must be unique per request (the server deduplicates to prevent replay); the path must match the final URL exactly, including the trailing slash.

import hashlib
import hmac
import time
import secrets

APP_ID = 'app_yourAppId'
APP_SECRET = 'sk_yourAppSecret'


def build_sign(params: dict, secret: str, method: str, path: str) -> str:
    """Join the uppercase method, a newline, the path, another newline and the parameters, then output lowercase hex via HMAC-SHA256"""
    items = sorted(
        (k, str(v)) for k, v in params.items()
        if k != 'sign' and v not in (None, '')
    )
    raw = method.upper() + '\n' + path + '\n' + '&'.join(f'{k}={v}' for k, v in items)
    return hmac.new(secret.encode(), raw.encode(), hashlib.sha256).hexdigest()


def signed_params(biz: dict, method: str, path: str):
    params = dict(biz)
    params.update({
        'app_id': APP_ID,
        'timestamp': str(int(time.time())),
        'nonce': secrets.token_hex(8),
    })
    params['sign'] = build_sign(params, APP_SECRET, method, path)
    return params

Example: signed_params({'keyword': 'Jay Chou'}, 'POST', '/api/music/xiaoying/search/').

Tip: the Live Debug page signs requests automatically with the keys you enter, so beginners don't need to compute signatures by hand; before going to production, make sure your implementation matches the server exactly.

Live Debug

1. Open API Docs Center, then select the target service on the left;
2. Enter your APPID / APPSECRET in "Auth Settings" on the right (stored only in your local browser, used to sign this request);
3. Fill in the parameters and click "Send Request"; the server calls the real /api/ endpoint and returns the result;
4. Public Endpoints (badge "Public · No Signature") can be debugged without a key.

Note: SMS, CAPTCHA and AI calls hit external services for real and may incur costs or send SMS; confirm before debugging.

FAQ