I've been playing about with Chrome extensions and one of the things I'd like to do is request product information from the Amazon Product Advertising API. The code to do this is pretty straight forward but so far the only way I can find to access the API is to create a signed request which involves using your AWS public and secret keys. Unfortunately this would mean embedding my AWS keys in the Chrome Extension which would allow anyone to access them so this is obviously a no go.
Does anyone know if the API can be accessed without including my secret key? Has anyone done this using Javascript (and in particular from a Chrome extension that allows me to get ignore the same origin policy).
I've been playing about with Chrome extensions and one of the things I'd like to do is request product information from the Amazon Product Advertising API. The code to do this is pretty straight forward but so far the only way I can find to access the API is to create a signed request which involves using your AWS public and secret keys. Unfortunately this would mean embedding my AWS keys in the Chrome Extension which would allow anyone to access them so this is obviously a no go.
Does anyone know if the API can be accessed without including my secret key? Has anyone done this using Javascript (and in particular from a Chrome extension that allows me to get ignore the same origin policy).
Share Improve this question asked Aug 17, 2013 at 15:07 RoarsterRoarster 8041 gold badge8 silver badges13 bronze badges 1-
May I ask how did you manage to make a call to AWS resources? I'm not able to do a simple
describeInstances. Can you please take a look at this? stackoverflow./questions/54869190 – Rad Commented Feb 26, 2019 at 7:39
2 Answers
Reset to default 7Looking into this it really seems like this can't be done directly from Javascript without potentially exposing your secret key. The only options I've discovered are:
- Host a server to do the work for you and talk directly to your server using Javascript
- Use a hosted service that will do the signing for you. One example I've found is http://apisigning./service.html - basically for a fee they appear to sign the request for you. Note that I haven't tested this.
Sadly, I think both of these options are a bit more than I'd planned on using so I've given up on my extension for now. It's a bit disappointing that Amazon don't allow easier access to their data but I guess they feel they have to protect it from petitors.
I guess you need a server to do your request! Lets the extension send the resquest to your server and there the request to amazon is done (php). The result of that you can use in your extension!