tencent cloud

Chat

제품 소개
제품 개요
Basic Concepts
응용 시나리오
기능 소개
계정 시스템
사용자 정보 및 관계망
메시지 관리
그룹 시스템
Official Account
Audio/Video Call
사용 제한
구매 가이드
과금 개요
요금 안내
Purchase Instructions
Renewal Guide
연체 안내
Refund Policy
다운로드 센터
SDK & Demo 소스 코드
업데이트 로그
시나리오 솔루션
Live Streaming Setup Guide
AI Chatbot
대규모 엔터테인먼트 협업 커뮤니티
Discord 구현 가이드
IM을 게임에 통합하는 방법
WhatsApp Channel-style Official Account Integration Solution
Send Red Packet
Firewall Restrictions
클라이언트 APIs
SDK API(Web)
Android
iOS & macOS
Swift
Flutter
Electron
Unity
React Native
C APIs
C++
서버 APIs
Secure authentication with UserSig
RESTful APIs
Webhooks
콘솔 가이드
New Console Introduction
애플리케이션 생성 및 업그레이드
기본 설정
기능 설정
계정 관리
그룹 관리
Official Channel Management
콜백 설정
모니터링 대시보드
Viewing Guide for Resource Packages
Real-Time Monitor
개발 보조 툴
액세스 관리
Advanced Features
FAQ
uni-app FAQs
구매
SDK 관련 질문
계정 인증
사용자 정보 및 관계망
메시지
그룹
라이브 방송 그룹
닉네임 및 프로필 사진
협약 및 인증
Service Level Agreement
컴플라이언스 인증
IM 정책
개인 정보 보호 정책
데이터 개인 정보 보호 및 보안 계약
에러 코드
문의하기
문서Chat서버 APIsSecure authentication with UserSig

Secure authentication with UserSig

PDF
포커스 모드
폰트 크기
마지막 업데이트 시간: 2025-12-16 14:12:06
UserSig (User Signature) is a security credential used by TRTC to authenticate user identities. When using TRTC services, such as initializing the SDK or logging in, you must provide a UserSig. TRTC uses this credential to verify the authenticity of the user and prevent malicious actors from hijacking your cloud service traffic. This document explains how to generate a UserSig.

The diagram below illustrates the authentication flow for generating a UserSig on the server in a production environment:




Prerequisites

Before you begin, ensure you have followed the Activate the Service guide to create an application and obtained the following information from the console:
SDKAppID: The unique identifier for your application
SDKSecretKey: The secret key for your application

Generating UserSig

You can generate a UserSig using one of the following three methods:
Via Console: Quickly generate a UserSig using your SDKAppID and UserID via the console. This method is intended for local testing and debugging only.
Client-side Generation: Use the open-source GenerateTestUserSig module provided by TRTC to generate a UserSig directly on the client. This allows for UserID customization and integration with your account system. This method is intended for local testing and debugging only.
Server-side Generation (Recommended for Production): Deploy the UserSig generation code on your backend server. Your app requests a dynamically generated UserSig from your server whenever needed. This is the most secure method and is required for production environments.

Console Generation

To quickly try out the product demo, generating a UserSig in the console is the most convenient approach:
1. Log in to the TRTC Console. In the left navigation panel of the Dashboard page, select Development Tools > UserSig Tools.
2. Select the SDKAppID of the application you want to test and enter the UserID.
3. Click Generate to create the corresponding UserSig.


Client-side Generation

TRTC provides open-source code on GitHub for the following programming languages to generate a UserSig. You can download and integrate the source code into your client, fill in your SDKAppID, SDKSecretKey, and set the validity period for the UserSig (EXPIRETIME) to generate a UserSig.
Programming Language
Platform
Source Code
Java
Android
Objective-C
iOS
Objective-C
Mac
C++
Windows
Dart
Flutter
Caution:
The SECRETKEY in this method can be easily reverse-engineered or decompiled. If your secret key is exposed, attackers can hijack your TRTC traffic. Therefore, this method is only suitable for local demo testing and feature debugging.
In a production environment, you must integrate the UserSig generation code into your business server and provide an API for your app. When the app needs a UserSig, it should request it from the server to obtain a dynamically generated UserSig. For details, see Server-side Generation.

Server-side Generation

Server-side generation ensures the security of your SecretKey. You can download the source code for your preferred language below and integrate it into your backend server.
The generation logic uses the standard HMAC-SHA256 algorithm.
Programming Language
Download Link
Java
Go
PHP
Node.js
Python
C#
C++
Using Go as an example, the function for generating UserSig requires the following parameters:
sdkappid: Application ID, the unique identifier for your application.
userId: User ID, up to 32 bytes. Only uppercase and lowercase letters (a-zA-Z), numbers (0-9), underscores, and hyphens are allowed.
expire: The validity period of the UserSig, in seconds.
userbuf: This parameter is set to null by default. In certain real-time audio and video scenarios, you may need to use an interface with userbuf, such as when joining a room. For details, see Room Entry Permission Protection.
key: The secret key for your application.

Go Example: Building a UserSig Generator
Note:
The code examples below are for local testing and verification only. Do not use this code directly in a production environment.
For production, integrate the UserSig generation logic into your backend server. Your client application should request the signature from your server via an API (e.g., HTTP).

Legacy Algorithm

To simplify the signature calculation, TRTC upgraded its signature algorithm from ECDSA-SHA256 to HMAC-SHA256 on July 19, 2019.
New Applications: All SDKAppIDs created after July 19, 2019, automatically use the new HMAC-SHA256 algorithm.
Existing Applications: If your application was created before this date, we recommend upgrading to the HMAC-SHA256 algorithm. This upgrade will not affect your live services.
If you prefer to continue using the legacy signature algorithm. Source code download links are as follows:
Programming Language
Download Link
Java
Go
PHP
Node.js
Python
C#
C++


도움말 및 지원

문제 해결에 도움이 되었나요?

피드백