Tencent cloud temporary secret key scheme - character recognition example

Temporary key usage guide

summary

Tencent cloud official website SecretId and SecretKey Is your important property . In the use of OCR Business needs to take advantage of SecretId and SecretKey To calculate the authentication signature , But if SecretId and SecretKey Write dead in SDK There is a great risk of leakage in the code of . therefore , While we support the use of fixed keys , Provides a way to use temporary keys .SDK The temporary key can be used for authentication signature calculation , To request OCR Identification interface . The redeemed temporary key has timeliness , Can greatly reduce SecretId and SecretKey The risk of leakage .

Temporary key exchange process

The flow chart of temporary key exchange is as follows :

As shown in the figure, the process of temporary key exchange can be roughly described as ：

1. The client of the user actively requests the server of the user to obtain the temporary key .
2. After the user's server receives the client request , Use the fixed key stored on the server as a parameter to request CAM service , Perform temporary key exchange .
3. CAM The service issues the temporary key to the user server .
4. The user server is receiving CAM After the temporary key generated by the service , Distribute this temporary key to the user's client .
5. After the client obtains the temporary key issued by the server , call SDK The interface provided to update the temporary key updates the temporary key . And then the client SDK Will use the updated temporary key , To request OCR service .

Reference link ：https://github.com/TencentCloud/tc-ocr-sdk/tree/master/%E4%B8%B4%E6%97%B6%E5%AF%86%E9%92%A5%E5%85%91%E6%8D%A2

One 、OCR Example of requesting a temporary secret key

api Secret key address ：https://console.cloud.tencent.com/cam/capi

Obtain temporary access credentials for federated identity （ Temporary secret key access document ）：https://cloud.tencent.com/document/product/1312/48195

Policy Join the reference , Character recognition OCR An example of a policy is as follows ：

{
    "version": "2.0",
    "statement": [
        {
            "action": [
                   "ocr:*"
        ],
        "resource": "*",
        "effect": "allow"
        }
    ]
}
 Be careful ： The format needs to be changed before coding , Such as ：
{ "version": "2.0", "statement": [{"action": ["ocr:*"],"resource": "*","effect": "allow"}]}
 Conduct urlencode code ：
%7b+%22version%22%3a+%222.0%22%2c+%22statement%22%3a+%5b%7b%22action%22%3a+%5b%22ocr%3a*%22%5d%2c%22resource%22%3a+%22*%22%2c%22effect%22%3a+%22allow%22%7d%5d%7d

Policy Join the reference , speech recognition ASR An example of a policy is as follows ：

{
    "version": "2.0",
    "statement": [
        {
            "action": [
                   "asr:*"
        ],
        "resource": "*",
        "effect": "allow"
        }
    ]
}
 Be careful ： The format needs to be changed before coding , Such as ：
{ "version": "2.0", "statement": [{"action": ["asr:*"],"resource": "*","effect": "allow"}]}
 Conduct urlencode code ：
%7b+%22version%22%3a+%222.0%22%2c+%22statement%22%3a+%5b%7b%22action%22%3a+%5b%22asr%3a*%22%5d%2c%22resource%22%3a+%22*%22%2c%22effect%22%3a+%22allow%22%7d%5d%7d

On-line API Explorer Address ：https://console.cloud.tencent.com/api/explorer?Product=sts&Version=2018-08-13&Action=GetFederationToken&SignVersion=

test result ：

Generate temporary secret key

Two 、 Temporary secret key test request - An example of a character recognition service

Call with a temporary secret key ocr service ：https://console.cloud.tencent.com/api/explorer?Product=ocr&Version=2018-11-19&Action=GeneralBasicOCR&SignVersion=

Need to click on more options , Enter the corresponding Token value ,Token The call was successful within the validity period （ Only older versions of api exploer Tools , Currently recommended SDK Code test ）

notes ：Token Valid until “ Obtain temporary access credentials for federated identity ” Interface （ Field ：DurationSeconds）： Default 1800 second , The maximum period of validity of the primary account can be set as 7200 second , The longest valid period of the sub account can be set as 129600 second .

call ocr service

Token Call after expiration OCR Failure ：

call ocr service

It will help you , Remember to make up a praise for me ！