Skip to content

Create a String to Sign

The 'string to sign' consolidates essential data about the request and the preceding canonical request, forming the basis for generating the signature.

The 'string to sign' combines the algorithm, date and time, credential scope, and the digest of the canonical request using the following structure: 

StringToSign =
        Algorithm + '\n' +
        RequestDateTime + '\n' +
        CredentialScope + '\n' +
        HashedCanonicalRequest

To construct the 'string to sign'.

  1. Start with the algorithm designation, followed by a newline character. For this instance, the algorithm used for calculating the canonical request's digest is SHA384, denoted as AWS4-HMAC-SHA384:

    AWS4-HMAC-SHA384\n

  2. Append the request date value, followed by a newline character. Use the ISO8601 basic format in UTC time zone (YYYYMMDD'T'HHMMSS'Z'). For instance:

    20181130T120049Z\n

  3. Add the credential scope value, followed by a newline character. This string consists of the date (YYYYMMDD), the targeted region (eu-west-1), the service requested (AmazonPay), and the termination string aws4_request, separated by slashes:

    20181130/eu-west-1/AmazonPay/aws4_request\n

  4. Append the hash of the canonical request created in step 1. This value must not be followed by a newline character. Ensure that the hashed canonical request is SHA384 encoded.

    316097191c79d640a0f0b434e043072c45ff0a51ab27972252e1d9ec47fcaa29f7b70ca010587390ed108513fed247f4

Sample String to Sign

AWS4-HMAC-SHA384
20181130T120049Z
20181130/eu-west-1/AmazonPay/aws4_request
316097191c79d640a0f0b434e043072c45ff0a51ab27972252e1d9ec47fcaa29f7b70ca010587390ed108513f