Amazon Associate Webservice to Product Advertising API

08. May, 2009 0 Comments

New name of Amazon Associate Webservice – Product Advertising API

Dear Amazon Associates Web Service Developer,

Through our Associates Program, we pay out hundreds of millions of dollars per year to websites that advertise our products. Effective immediately, we are renaming the Amazon Associates Web Service as the “Product Advertising API.” This new name more accurately reflects the purpose of the API, which is to enable developers to advertise products offered on the Amazon sites and thereby receive advertising fees from us.
In addition to the new name, signatures will be necessary to authenticate each call to the Product Advertising API. This requirement will be phased in starting May 11, 2009, and by August 15, 2009, all calls to the Product Advertising API must be authenticated or they will not be processed. For pointers on how you can easily authenticate requests to the Product Advertising API, please refer to the developer guide, available here.

Finally, the terms and conditions governing your use of the service have been migrated to a separate Product Advertising API License Agreement, available here. Except for the requirement that all requests be authenticated, the terms are substantially the same. If you obtain content through a data feed, your access to that data feed and use of that content will also be subject to the Product Advertising API License Agreement. By using the Product Advertising API or data feed, or content obtained through them, you are agreeing to the terms and conditions of the Product Advertising API License Agreement, and all uses of the API, data feed, or content must comply with that agreement.

Add more security feature. By Use public – private key authenticate.
Caller should encrypt message before send to Amazon, Secret key must keep in safe zone

hmacauthprocess_you1

When Amazon get the request message, They will decrypt it and validate key before response

Look it’s secure more. With the complicate request

Links

https://affiliate-program.amazon.com/gp/advertising/api/detail/agreement.html
http://www.faqs.org/rfcs/rfc2104.html

Deep Detail (Read more)

http://docs.amazonwebservices.com/AWSECommerceService/latest/DG/index.html?rest-signature.html

http://developer.amazonwebservices.com/connect/entry.jspa?externalID=2433

http://en.wikipedia.org/wiki/%5Cn#Newline_in_programming_languages

http://mierendo.com/software/aws_signed_query/

Example of Rest Request

Steps to Sign the Example Request

Enter the timestamp. For this example, we’ll use GMT time of 2009-01-01T12:00:00Z

http://webservices.amazon.com/onca/xml?Service=AWSECommerceServic
e&AWSAccessKeyId=00000000000000000000&Operation=ItemLookup&ItemId
=0679722769&ResponseGroup=ItemAttributes,Offers,Images,Reviews&Ve
rsion=2009-01-06&Timestamp=2009-01-01T12:00:00Z

URL encode the request’s comma (,) and colon (;) characters, so that they don’t get misinterpreted. For more information about converting to RFC 3986 specifications, see documentation and code samples for your programming language.
```
http://webservices.amazon.com/onca/xml?Service=AWSECommerceServic
e&AWSAccessKeyId=00000000000000000000&Operation=ItemLookup&ItemId
=0679722769&ResponseGroup=ItemAttributes%2COffers%2CImages%2CRevi
ews&Version=2009-01-06&Timestamp=2009-01-01T12%3A00%3A00Z
```
Important

Be sure that you do not double-escape any characters.

	Important
Be sure that you do not double-escape any characters.

Split the parameter/value pairs and delete the ampersand characters (&) so that the example looks like the following:

Service=AWSECommerceService
AWSAccessKeyId=00000000000000000000
Operation=ItemLookup
ItemId=0679722769
ResponseGroup=ItemAttributes%2COffers%2CImages%2CReviews
Version=2009-01-06
Timestamp=2009-01-01T12%3A00%3A00Z

Sort your parameter/value pairs by byte value (not alphabetically, lowercase parameters will be listed after uppercase ones).

AWSAccessKeyId=00000000000000000000
ItemId=0679722769
Operation=ItemLookup
ResponseGroup=ItemAttributes%2COffers%2CImages%2CReviews
Service=AWSECommerceService
Timestamp=2009-01-01T12%3A00%3A00Z
Version=2009-01-06

Rejoin the sorted parameter/value list with ampersands. The result is the canonical string that we’ll sign:

AWSAccessKeyId=00000000000000000000&ItemId=0679722769&Operation=I
temLookup&ResponseGroup=ItemAttributes%2COffers%2CImages%2CReview
s&Service=AWSECommerceService&Timestamp=2009-01-01T12%3A00%3A00Z&
Version=2009-01-06

Prepend the following three lines (with line breaks) before the canonical string:
```
GET
webservices.amazon.com
/onca/xml
```

The string to sign:

GET
webservices.amazon.com
/onca/xml
AWSAccessKeyId=00000000000000000000&ItemId=0679722769&Operation=I
temLookup&ResponseGroup=ItemAttributes%2COffers%2CImages%2CReview
s&Service=AWSECommerceService&Timestamp=2009-01-01T12%3A00%3A00Z&
Version=2009-01-06

Calculate an RFC 2104-compliant HMAC with the SHA256 hash algorithm using the string above with our “dummy” Secret Access Key: 1234567890. For more information about this step, see documentation and code samples for your programming language.
```
Nace+U3Az4OhN7tISqgs1vdLBHBEijWcBeCqL5xN9xg=
```
URL encode the plus (+) and equal (=) characters in the signature:
```
Nace%2BU3Az4OhN7tISqgs1vdLBHBEijWcBeCqL5xN9xg%3D
```

Add the URL encoded signature to your request and the result is a properly-formatted signed request:

http://webservices.amazon.com/onca/xml?AWSAccessKeyId=00000000000
000000000&ItemId=0679722769&Operation=ItemLookup&ResponseGroup=It
emAttributes%2COffers%2CImages%2CReviews&Service=AWSECommerceServ
ice&Timestamp=2009-01-01T12%3A00%3A00Z&Version=2009-01-06&Signatu
re=pwqYQRc3RepIrf7m%2BVMRy%2FjFXx%2FZBSPsaSFFexIUoSI%3D