腾讯云API接口鉴权v3 鉴权失败问题 AuthFailure.SignatureFailure（转载）

最近我开发的CRM项目正好在做营销短信的功能，这个功能需要对接腾讯云的第三方短信接口。众所周知，对接接口最难的就是鉴权部分了，毕竟为了安全嘛。云API鉴权一直是比较晦涩难懂的，建议大家还是去github下载安装SDK，可以免去鉴权这一步，非常方便。

但是既然发这篇文章，我最终还是选择了使用API的方式。下面简单说一下我在鉴权遇到的坑：

{“Response”:{“Error”:{“Code”:“AuthFailure.SignatureFailure”,“Message”:“The provided credentials could not be validated. Please check your signature is correct.”},“RequestId”:“1c56be9c-844f-43bf-ac2a-587be2b5aa7a”}}
调用接口的时候一直在报这个鉴权错误，使用腾讯云提供的工具 API Explorer 测试发现程序可以运行，参数也都是对的。

下面是腾讯提供的源码：

<?php $secretId = "AKIDz8krbsJ5yKBZQpn74WFkmLPx******"; $secretKey = "Gu5t9xGARNpq86cd98joQY******"; $host = "cvm.tencentcloudapi.com"; $service = "cvm"; $version = "2017-03-12"; $action = "DescribeInstances"; $region = "ap-guangzhou"; // $timestamp = time(); $timestamp = 1551113065; $algorithm = "TC3-HMAC-SHA256"; // step 1: build canonical request string $httpRequestMethod = "POST"; $canonicalUri = "/"; $canonicalQueryString = ""; $canonicalHeaders = "content-type:application/json; charset=utf-8\n"."host:".$host."\n"; $signedHeaders = "content-type;host"; $payload = '{"Limit": 1, "Filters": [{"Values": ["\u672a\u547d\u540d"], "Name": "instance-name"}]}'; $hashedRequestPayload = hash("SHA256", $payload); $canonicalRequest = $httpRequestMethod."\n" .$canonicalUri."\n" .$canonicalQueryString."\n" .$canonicalHeaders."\n" .$signedHeaders."\n" .$hashedRequestPayload; echo $canonicalRequest.PHP_EOL; // step 2: build string to sign $date = gmdate("Y-m-d", $timestamp); $credentialScope = $date."/".$service."/tc3_request"; $hashedCanonicalRequest = hash("SHA256", $canonicalRequest); $stringToSign = $algorithm."\n" .$timestamp."\n" .$credentialScope."\n" .$hashedCanonicalRequest; echo $stringToSign.PHP_EOL; // step 3: sign string $secretDate = hash_hmac("SHA256", $date, "TC3".$secretKey, true); $secretService = hash_hmac("SHA256", $service, $secretDate, true); $secretSigning = hash_hmac("SHA256", "tc3_request", $secretService, true); $signature = hash_hmac("SHA256", $stringToSign, $secretSigning); echo $signature.PHP_EOL; // step 4: build authorization $authorization = $algorithm ." Credential=".$secretId."/".$credentialScope .", SignedHeaders=content-type;host, Signature=".$signature; echo $authorization.PHP_EOL; $curl = "curl -X POST https://".$host .' -H "Authorization: '.$authorization.'"' .' -H "Content-Type: application/json; charset=utf-8"' .' -H "Host: '.$host.'"' .' -H "X-TC-Action: '.$action.'"' .' -H "X-TC-Timestamp: '.$timestamp.'"' .' -H "X-TC-Version: '.$version.'"' .' -H "X-TC-Region: '.$region.'"' ." -d '".$payload."'"; echo $curl.PHP_EOL; 解决方法： 1、$payload参数是一个字符串，字符串里的内容是你传的参数json_encode后的内容（很多同学这个参数直接传了json格式，应该是字符串！）。 2、$canonicalHeaders参数里面如果有设置编码的参数charset=utf-8的话，那么请求头header中也必须要有这个参数并且空格也要保持一致，上面有空格，下面也要有，反之就会鉴权失败。 3、希望大家都注意一下细节，找问题的过程真的很曲折。 原文链接：[https://blog.csdn.net/zhaoerzheng/article/details/107694458?utm_medium=distribute.pc_feed.none-task-blog-personrec_tag-3.nonecase&depth_1-utm_source=distribute.pc_feed.none-task-blog-personrec_tag-3.nonecase&request_id=5f439085cea070620e93e816](https://blog.csdn.net/zhaoerzheng/article/details/107694458?utm_medium=distribute.pc_feed.none-task-blog-personrec_tag-3.nonecase&depth_1-utm_source=distribute.pc_feed.none-task-blog-personrec_tag-3.nonecase&request_id=5f439085cea070620e93e816)