Authentication

All API calls are signed with a secret shared key using the HMAC-SHA1 (Hash-based Message Authentication Code) algorithm. The message to be authenticated is constructed using the arguments of the request, and is computed as follows:

1. List the request’s arguments, for instance:

   api_key = API_KEY
   time_stamp = 20090612111832
   img = @/path/to/image.jpg;type=image/jpg
   json = 1

2. Compute the message by sorting the arguments into alphabetical order, and concacenating the arguments name-value pairs (if the argument in an image only keep the name of the file):

   m = api_keyAPI_KEYimgimage.jpgjson1time_stamp20090612111832
   

3. Compute the message authentication code using HMAC-SHA1:

   HMAC-SHA1(secret, m)
   

There exists HMAC implementations in Python, Java, and Objective-C.

You can also compute the signature from the command line with OpenSSL! Here is how to do it:

TIME_STAMP=`date -u +%Y%m%d%H%M%S`
M=api_keyAPI_KEYimage.jpgjson1time_stamp$TIME_STAMP
API_SIG=`echo -n $M | openssl dgst -sha1 -hmac $SECRET`

In case you are having trouble with implementing the authentication component, use the Authentication Debug Tool to help verify that you are computing your HMAC-SHA1 signatures in the same way as our API servers.