Original Unsigned Request
http://webservices.amazon.com/onca/xml?Service=AWSECommerceService&AWS
AccessKeyId=00000000000000000000&Operation=SimilarityLookup&ItemI
d=B0011ZK6PC,B000NK8EWI&Version=2009-01-01&AssociateTag=mytag-20&
ResponseGroup=Offers,ItemAttributes&SimilarityType=Intersection&C
ondition=New&Merchant=Amazon
String to Sign
GET
webservices.amazon.com
/onca/xml
AWSAccessKeyId=00000000000000000000&AssociateTag=mytag-20&Conditi
on=New&ItemId=B0011ZK6PC%2CB000NK8EWI&Merchant=Amazon&Operation=S
imilarityLookup&ResponseGroup=Offers%2CItemAttributes&Service=AWS
ECommerceService&SimilarityType=Intersection&Timestamp=2009-01-01
T12%3A00%3A00Z&Version=2009-01-01
Signed Request
http://webservices.amazon.com/onca/xml?AWSAccessKeyId=0000000000000000
0000&AssociateTag=mytag-20&Condition=New&ItemId=B0011ZK6PC%2CB000
NK8EWI&Merchant=Amazon&Operation=SimilarityLookup&ResponseGroup=O
ffers%2CItemAttributes&Service=AWSECommerceService&Signature=I2pb
qxuS%2FmZK6Apwz0oLBxJn2wDL5n4kFQhgYWgLM7I%3D&SimilarityType=Inter
section&Timestamp=2009-01-01T12%3A00%3A00Z&Version=2009-01-01
Authenticating SOAP Requests
Topics
•
Using SOAP with WS-Security (p. 66)
•
Using SOAP without WS-Security (p. 71)
The Product Advertising API accepts SOAP requests sent over an HTTPS connection only. We prefer
that you use WS-Security because it is the most secure. However, if your SOAP toolkit does not support
WS-Security, you can authenticate SOAP requests with your AWS secret key instead.
Using SOAP with WS-Security
WS-Security, which is officially called Web Services Security: SOAP Message Security, is an open
standard published by OASIS that defines mechanisms for signing and encrypting SOAP messages.
Product Advertising API supports version 1.0 of the WS-Security specification. For more information and
a link to the WS-Security 1.0 specification, go to the
OASIS-Open web site for WS-Security
.
Tip
The easiest way to comply with the WS-Security requirements is to use a SOAP toolkit that
supports WS-Security 1.0 and X.509 certificates.
Caution
For the purposes of request security and integrity, you must send all SOAP requests over HTTPS.
API Version 2011-08-01
66
Product Advertising API Developer Guide
Request Authentication