Skip to content

Sign a request

All Content API requests must have the sign parameter. MEGOGO uses it to identify your key and to make sure that nobody changed the request. This page shows how to calculate the signature, with a worked example and code.

The Billing API does not use signatures. MEGOGO identifies Billing API requests by the IP address of your server. See Credentials.

The algorithm

  1. Write the request parameters in the same order as in the URL. Do not include sign.
  2. Join each name and value with =. Join the pairs with no separator.
  3. Add the private key at the end of the text.
  4. Calculate the MD5 hash of the text (UTF-8). Write it in lowercase hexadecimal (32 characters).
  5. Add the public key at the end of the hash.
  6. Add sign as the last parameter of the URL.
sign = md5("name1=value1name2=value2" + private_key) + public_key

Parameter values

  • Use the decoded values in the signature. For example, use the text Гарри Поттер, not %D0%93….
  • Encode the values only in the URL (percent-encoding). A space can be %20 or +.
  • Include all parameters, also lang, access_token and page.

Worked example

The example uses invented keys:

Value Example
Private key 0123456789
Public key _example1_xx
Request GET /v1/stream?video_id=12345&lang=en

  1. Join the parameters in the URL order:

    video_id=12345lang=en

  2. Add the private key:

    video_id=12345lang=en0123456789

  3. Calculate the MD5 hash:

    a2330689677230e571d9266512049f63

  4. Add the public key:

    a2330689677230e571d9266512049f63_example1_xx

  5. Add sign to the URL:

    https://api.megogo.net/v1/stream?video_id=12345&lang=en&sign=a2330689677230e571d9266512049f63_example1_xx

More examples with the same keys:

Request parameters Text before the MD5 hash sign
(none) 0123456789 781e5e245d69b566979b86e28d23f2c7_example1_xx
text=Гарри Поттер, lang=en text=Гарри Поттерlang=en0123456789 2064e00bc2f05342a0b4317617052a82_example1_xx
paging_strategy=token, page=PjIw, category_id=16 paging_strategy=tokenpage=PjIwcategory_id=160123456789 df30340661b66a578f6b355a7beeaf0e_example1_xx

Use these examples to test your code.

Code

The functions get the parameters as a list of name–value pairs in the URL order.

from hashlib import md5
from urllib.parse import urlencode

def sign(params, private_key, public_key):
    data = "".join(f"{name}={value}" for name, value in params) + private_key
    return md5(data.encode("utf-8")).hexdigest() + public_key

def signed_url(base, path, params, private_key, public_key):
    query = list(params) + [("sign", sign(params, private_key, public_key))]
    return f"{base}/{path}?{urlencode(query)}"

print(signed_url("https://api.megogo.net/v1", "stream",
                 [("video_id", "12345"), ("lang", "en")],
                 "0123456789", "_example1_xx"))

const crypto = require("crypto");

function sign(params, privateKey, publicKey) {
  const data = params.map(([name, value]) => `${name}=${value}`).join("") + privateKey;
  return crypto.createHash("md5").update(data, "utf8").digest("hex") + publicKey;
}

function signedUrl(base, path, params, privateKey, publicKey) {
  const query = new URLSearchParams([...params, ["sign", sign(params, privateKey, publicKey)]]);
  return `${base}/${path}?${query}`;
}

console.log(signedUrl("https://api.megogo.net/v1", "stream",
  [["video_id", "12345"], ["lang", "en"]], "0123456789", "_example1_xx"));

<?php
function megogo_sign(array $params, string $privateKey, string $publicKey): string {
    $data = '';
    foreach ($params as [$name, $value]) {
        $data .= $name . '=' . $value;
    }
    return md5($data . $privateKey) . $publicKey;
}

function megogo_signed_url(string $base, string $path, array $params,
                           string $privateKey, string $publicKey): string {
    $query = [];
    foreach ($params as [$name, $value]) {
        $query[] = rawurlencode($name) . '=' . rawurlencode($value);
    }
    $query[] = 'sign=' . rawurlencode(megogo_sign($params, $privateKey, $publicKey));
    return $base . '/' . $path . '?' . implode('&', $query);
}

echo megogo_signed_url('https://api.megogo.net/v1', 'stream',
    [['video_id', '12345'], ['lang', 'en']], '0123456789', '_example1_xx');

All three examples give the URL from step 5 of the worked example.

CAUTION

Do not put the parameters in a dictionary or a map that changes the order. Some languages sort the keys. Then the signature is not correct.

Errors

Response Cause Action
HTTP 400, "message": "You entered wrong sign key" The signature is not correct, sign is not in the request, or the public key is not known Make sure that the parameter order in the signature is the same as in the URL. Make sure that you used the decoded values
HTTP 400, "message": "You entered wrong sign key" for requests with a user only access_token is not in the signature Include access_token in the signature
HTTP 200, "result": "error", "code": 400 The signature is correct, but a parameter is not correct or not in the request Read the Content API reference