Auth and Signing

Weydub API requests use AppKey and AppSign headers. Keep AppSecret server-side only.

Request Structure

Headers

Content-Type: application/json
AppKey: your_app_key
AppSign: computed_signature

AppSecret is never sent as a header or body field. It is only used on your server to compute AppSign.

Signature Formula

AppSign = md5(md5(request_body) + AppSecret)

The signature must be calculated from the exact JSON body sent over the wire. For stable signatures, serialize JSON without extra spaces.

If an endpoint permits an empty body, sign the exact bytes you send. In most integrations, prefer sending {} and signing {} for bodyless calls.

Unsigned Endpoint

The enum endpoint does not require signing:

POST /v-w-c/enum/query2

Use it to fetch dynamic language/status enums such as sourceLang, Lang, ProcessStatus, and ImageTaskStatus.

Python Signing Helper

import hashlib
import json


def signed_body_and_headers(payload: dict, app_key: str, app_secret: str):
    body = json.dumps(payload, ensure_ascii=False, separators=(",", ":"))
    body_md5 = hashlib.md5(body.encode("utf-8")).hexdigest()
    app_sign = hashlib.md5((body_md5 + app_secret).encode("utf-8")).hexdigest()
    return body, {
        "Content-Type": "application/json",
        "AppKey": app_key,
        "AppSign": app_sign,
    }

Node Signing Helper

import crypto from "node:crypto";

export function signedBodyAndHeaders(payload, appKey, appSecret) {
  const body = JSON.stringify(payload);
  const bodyMd5 = crypto.createHash("md5").update(body).digest("hex");
  const appSign = crypto.createHash("md5").update(bodyMd5 + appSecret).digest("hex");
  return {
    body,
    headers: {
      "Content-Type": "application/json",
      AppKey: appKey,
      AppSign: appSign,
    },
  };
}

cURL Pattern

Use your backend to compute AppSign, then send the exact body:

curl -X POST "https://api.zhaoli.com/v-w-c/gateway/ve/work/status" \
  -H "Content-Type: application/json" \
  -H "AppKey: $WEYDUB_APP_KEY" \
  -H "AppSign: $WEYDUB_APP_SIGN" \
  --data '{"idWorks":[488026661]}'

Callback Signing

When Weydub sends a callback, it includes:

Callback-Sign: computed_callback_signature

Verify callbacks with the same formula, using the raw callback request body:

expected = md5(md5(raw_callback_body) + AppSecret)

Compare expected with Callback-Sign. Reject or quarantine callback payloads that fail verification.

Common Mistakes

• Signing pretty-printed JSON but sending compact JSON.
• Mutating the payload after signing.
• Using different string escaping between signing and sending.
• Signing an object in memory instead of the final bytes sent over HTTP.
• Forgetting that extraOptions, wyVoiceParam, videoInpaintMasks, downloadInfo, and redo result may need to remain compact JSON strings inside the outer JSON body.
• Putting credentials in frontend code.
• Sharing AppSecret with browser extensions, client-side apps, screenshots, logs, or public prompts.

Agent Rules

• Read credentials from environment variables or a secret manager.
• Never echo AppSecret.
• Never write credentials into generated sample files.
• When producing runnable examples, use placeholders or environment variables.
• When debugging a signature error, compare body bytes and non-secret body hashes without printing secrets.
• Verify Callback-Sign for webhook handlers.