接口调用的安全与鉴权机制
Ant Messenger 开放平台面向集成场景提供接口安全机制 that adopts the international mainstream end-to-end encryption method to secure messages, and supports instant burn after reading, anti-screenshot, and two-way deletion without leaving traces.
本页汇总 Ant Messenger 开放平台在 API 调用、回调签名、IP 白名单与应用权限方面的安全机制。
安全机制一览
以下机制均来自 ome-antmessenger.com.cn 的公开说明。
| 消息加密 | 端到端加密 using the international mainstream method. |
|---|---|
| 阅后即焚消息 | Supports 阅后即焚. |
| 截屏控制 | 防截屏 protection. |
| 消息删除 | 双向删除 without leaving traces. |
| 群消息传输 | Group messages are encrypted through TLS, in groups of up to 10 万 people. |
| 云盘存储 | Files uploaded to the cloud disk are 高强度加密, with no limit on capacity or time. |
| 身份隐私 | Phone number and user ID can be 可隐藏; an 应用锁 can be set. |
| 设备接入 | Up to 5 台设备 can be logged in simultaneously with real-time chat sync. |
| 源码可用性 | 开源 — the source code can be viewed free of charge. |
Ant Messenger 如何保护消息安全
Ant Messenger 开放平台对接口调用采用应用级鉴权与传输加密，回调支持签名校验，防止伪造请求。
Because the application is 开源, the implementation can be inspected directly. Ant Messenger states that users are free to use and view the source code.
阅后即焚与双向删除
Ant Messenger supports 阅后即焚, so a message can be made to disappear once it has been read. It also supports 双向删除不留痕, which removes the message for both sides of the conversation rather than only on the device that issued the deletion.
防截屏保护
In addition to ephemeral and deletable messages, Ant Messenger provides 防截屏 protection. This is intended to limit copying of conversation content through device screenshots.
群组与云盘安全
Ant Messenger supports 超级群组 with up to 10 万人 communicating online. Group messages are encrypted through TLS (Transport Layer Security), which protects group traffic while it travels over the network.
For files, Ant Messenger provides 云盘存储. Files uploaded to the cloud disk are described as highly encrypted, and there is 不限容量、不限时间.
账号与设备保护
隐藏身份标识
你可以隐藏手机号与用户 ID，减少在其他参与者面前暴露的个人信息。
应用锁
可为应用设置应用锁，限制他人在本设备上查看你的会话。
多设备管理
最多 5 台设备可同时登录并实时同步，你可以随时查看账号在哪些设备上处于活跃状态。
关于接口安全的常见问题
接口调用如何鉴权？
采用应用级 API 鉴权，支持按应用分配最小权限与 IP 白名单。
回调请求会被伪造吗？
不会。Webhook 回调支持签名校验，服务端可验证请求来源。
调用频次有限制吗？
有。支持按应用配置调用频次限制，并提供调用日志查询。
消息推送是否加密？
是。接口调用与消息推送均通过加密传输，群消息经 TLS 加密。
单点登录如何对接？
支持 OIDC 单点登录对接与账号体系同步，详见开放平台文档。