Authentication consists of two parts:
- Identity verification: The use of keys ensures that requests are not tampered with during transmission. The request URL contains the key ID and signature key. On the server side, the system obtains the user's key based on the key ID, recalculates the signature, and compares it with the incoming one. If the signatures match, the request is considered valid.
- Permission control: Permissions can be defined at the resource level or defined more precisely at the API level.