Tablestore uses symmetric signatures to verify whether a request is sent by the resource owner and whether the response is sent by Tablestore.
After you create an Alibaba Cloud account, you can create an AccessKey pair in the User Management Console. For more information, see Obtain an AccessKey pair. An AccessKey ID identifies a user. An AccessKey secret is used to sign and verify requests and responses. Keep the AccessKey secret secure.
When you send a request, you must include the request plaintext, AccessKey ID, and the verification code generated based on the signature calculated by using AccessKey secret and request plaintext.
After Tablestore receives the request, Tablestore uses the AccessKey ID to obtain the corresponding AccessKey secret and signs the plaintext by using the same method. If the calculated verification code is the same as what is provided by the client, the request is valid.
The client uses the same method to verify whether the calculated verification code is the same as what is provided by the server. If the verification codes are the same, the response is valid.