Secure Hash (SHA-256 or MD5) authenticated GraphQL I/O Doc usage reference

When using Secure Hash authentication, the developer passes an api_key and a computed sig as query parameters. Cloud API Management computes a time-based HMAC signature from your API key, shared secret, and a Unix timestamp, then appends it as a sig query parameter on every request. You do not compute the signature manually, the Developer Portal handles it automatically.

The authentication type is determined by the Request Authentication Type field - Key + Secret + Timestamp Hash (SHA-256) or Key + Secret + Timestamp Hash (MD5) - and the API key location - Header, Parameters, or Path - is determined by the Developer's API Key Location field configured on the Key & Method Detection page.

Depending on the authentication configuration on the Key & Method Detection page, the GraphQL editor automatically loads the correct credential form. The developer must enter their application's API key and shared secret in the GraphQL editor's authentication field.

Use case: Secure Hash (SHA-256 or MD5)

The following is an example of how to test a Secure Hash (SHA-256 or MD5) authenticated GraphQL I/O Doc on the Developer Portal > Interactive Documentation page.

Adding a query

On the left-hand side, the editor automatically fetches all the query fields from the schema configured for an endpoint on the Key & Method Detection page.

The Request Authentication Type is set to Key + Secret + Timestamp Hash (SHA-256) or Key + Secret + Timestamp Hash (MD5), and the Developer's API Key Location is set to Header, Parameters, or Path on the Key & Method Detection page. Next, ensure you have configured the public and backend domains and paths on the Domains & Traffic Routing page. Review Prerequisites for using Secure Hash (SHA-256 or MD5) authenticated GraphQL I/O Doc for more information.

To test your GraphQL API, copy the API key and shared secret from the Package Key Settings page and paste them into the GraphQL editor's authentication field. Add query fields or write a query directly in the editor, then click Execute query. The editor sends your API key as a query parameter and automatically computes and appends the HMAC signature (sig) to every request. The shared secret is never sent, it is used only for signature computation. On the right-hand side, the query returns results as a JSON object in the editor.