Fix Xiaohongshu / RED App Developer API “接口调用受限 / 身份验证失败” (2026 Practical Guide)

import time
import hashlib
import hmac
import requests

def generate_xhs_signature(app_key, app_secret, path, params):
    """
    Generates compliant HMAC-SHA256 signature for Xiaohongshu Open Platform APIs.
    """
    # 1. Sort query parameters alphabetically by key
    sorted_params = sorted(params.items())
    
    # 2. Build canonical request string: path + sorted params
    param_string = "".join([f"{k}{v}" for k, v in sorted_params])
    string_to_sign = f"{path}?{param_string}"
    
    # 3. Calculate HMAC-SHA256 signature using AppSecret
    signature = hmac.new(
        app_secret.encode('utf-8'),
        string_to_sign.encode('utf-8'),
        hashlib.sha256
    ).hexdigest().lower()
    
    return signature

# Usage Example:
APP_KEY = "your_xhs_app_key"
APP_SECRET = "your_xhs_app_secret"
API_PATH = "/api/open/v1/note/published"

# Request parameters including Beijing timestamp (ms)
params = {
    "app_key": APP_KEY,
    "timestamp": str(int(time.time() * 1000)),
    "version": "2.0"
}

# Generate signature and append to headers
sign = generate_xhs_signature(APP_KEY, APP_SECRET, API_PATH, params)
headers = {
    "Content-Type": "application/json",
    "X-Sign": sign
}

print(f"Generated X-Sign Header: {sign}")
# Execute request via China proxy node
# response = requests.get(f"https://open.xiaohongshu.com{API_PATH}", params=params, headers=headers, proxies=china_proxies)