v2.6 API Authentication

The v2.6 API supports App Key & App Secret authentication and legacy token authentication. App Key & App Secret is recommended because requests are signed without exposing the secret.

WARNING

v2.6 credentials are part of the URL path. This differs from v1 and v3.

App Key & App Secret

Place the App Key in the credential segment of the path and include the signature headers:

curl "https://api.caiyunapp.com/v2.6/{app_key}/{longitude},{latitude}/{endpoint}?{query}" \
  -H "x-cy-nonce: {nonce}" \
  -H "x-cy-timestamp: {timestamp}" \
  -H "x-cy-signature: {signature}"

To calculate x-cy-signature:

1. Sort and URL-encode the query parameters.
2. Join the values as {method}:{path}:{query}:{app_key}:{nonce}:{timestamp}. The path includes the App Key.
3. Calculate HMAC-SHA256 with the App Secret.
4. Encode the result with URL-safe Base64.

Use a unique 16–40 character nonce for every request. The timestamp is Unix time in seconds.

Token Authentication

WARNING

Token authentication can expose credentials through URLs and logs. Prefer App Key & App Secret.

Pass the API authentication credential in the path:

curl "https://api.caiyunapp.com/v2.6/{token}/{longitude},{latitude}/{endpoint}"