## Overview
Kingdee Cloud Cosmic-Star (jdy) uses a two-layer credential system — keep them straight:
1. ISV/app-layer client_id/client_secret, issued when the app is created on the Kingdee open platform; used for the X-Api-ClientID header and as the HMAC key of X-Api-Signature.
2. Tenant/app-set-layer app_key/app_secret, pushed by the platform after the enterprise admin authorizes the app (push_app_authorize); used to compute app_signature and exchange for an app-token.
### Token exchange steps
1. Compute app_signature: HmacSHA256 with app_secret as key and app_key as message, take the lowercase hex string and Base64-encode that hex string (not the raw digest bytes).
2. POST this endpoint with app_key, app_secret and app_signature in the query.
3. On success you receive an app-token and a domain (gateway routing address).
### Per-request signing
Every business call carries headers: X-Api-ClientID, X-Api-TimeStamp (ms), X-Api-Nonce, X-Api-SignHeaders (fixed "X-Api-TimeStamp,X-Api-Nonce"), X-Api-Auth-Version (2.0), X-Api-Signature, app-token and X-GW-Router-Addr (the domain from the token step — missing means 404). The string-to-sign is uppercase method + LF + urlencode(path) + LF + double-rawurlencoded query + LF + x-api-nonce + LF + x-api-timestamp + LF, HMAC-SHA256 with client_secret, hex then Base64.
### Production advice
The signing details are treacherous (encoding order, lowercase header names, trailing newline). Use the official SDK or the Qeasy Cosmic-Star connector — do not hand-roll this signer.