Request signing
What changes
Section titled “What changes”On top of the private key, each request carries an Ed25519 signature:
- You generate the key pair on your server and give us only the public half. The signing key never leaves your server, and we store nothing secret, so even a full copy of our database cannot forge your calls.
- Each request is signed over its method, path, a hash of the body, a timestamp and a random nonce.
- Replays are refused. We accept a signature only within 60 seconds of its timestamp (either side), and never accept the same nonce twice. A request copied from a log is useless.
How you will prepare
Section titled “How you will prepare”- Generate an Ed25519 key pair on the server that calls the API and keep the private half in your secret store.
- Send us the public half in your ticket when we announce signing; it is not a secret.
- Keep your server clock synced (NTP); a clock more than 60 seconds off will be refused.
Existing keys keep working while you switch; there is no migration on your side beyond adding the signature.