tencent cloud

Communicating with Tencent Cloud Server

Your server can communicate with the Tencent Cloud server using the methods below.

• API call: Tencent Cloud provides a series of live streaming APIs for your backend server to query and manage stream status, among others.
• Notification: Tencent Cloud can send messages (JSON) to your backend server when particular events occur, for example, when the status of a live stream changes or when a recording file is generated. You only need to register a callback URL in Tencent Cloud to receive event notifications.

API Call

Tencent Cloud offers a series of live streaming APIs for your backend sever to query and manage stream status, among others. For details, please see API Category.

Calling method

You can call the APIs on your server using the HTTP GET method (i.e., inserting the query parameters in the request URL). For the specific method, see the sample code in the API documentation.

Security mechanism

Using HTTP for API calls can ensure performance, but it’s essential to introduce a mechanism to secure the communication between your server and the Tencent Cloud backend.

All live streaming cloud APIs use the same security mechanism: t + sign verification.

• t (expiration time): If the current time is later than the t value specified in an API request or notification, the request or notification is considered invalid. This can prevent network replay attacks. The value of t is a Unix timestamp, i.e., the number of seconds that have elapsed since 00:00:00 UTC/GMT, January 1, 1970.

• sign (security signature): sign = MD5 (key + t). This means splicing the encryption key and t into a string and calculating its MD5 checksum. The encryption key is the CGI calling key, which can be specified in the CSS console. The directions below show how to configure authentication for stream publishing.

  1. Click Domain Management, find your publishing domain, and click Manage.
  2. Click Push Configuration and, in the Authentication Configuration section, and click Edit.

     Note：

     To configure authentication for a playback domain name, click Domain Management, find your playback domain, click Manage to go to the details page, select Access Control, and click Edit in the Authentication Configuration** section.

• How it works
  MD5 is an irreversible hash algorithm, so as long as the key is not disclosed, even if attackers have multiple pairs of t and sign values, they cannot calculate the keys and therefore cannot launch spoofing attacks.

• Calculation example
  Assume that the current time is 11:46:00, July 21, 2021 and the validity period is 1 minute. That means requests or notifications carrying the t value after 11:47:00, July 21, 2021 would be considered invalid.

  t = "2021-07-21 11:47:00" = 1626839220
  

  Assume that the key is 5d41402abc4b2a76b9719d911017c592. The signature value would be:

  sign = MD5(5d41402abc4b2a76b9719d911017c5921626839220）= 5ee8ca6c28cbe415b40352969cdf8249
  

Error Codes

HTTP errors

Common API errors

Frontend API access errors

Backend API query errors

Note：

The above error codes apply only to the APIs listed in this document and do not include event notifications.

Notification

For details about notifications, please see Callback Event Message Notification.