Request Signing
Pronunciation: ree-KWEST SYE-ning
Definition
Request signing uses a cryptographic key to create a verifiable signature over selected request data so a server can authenticate integrity and origin. Secure use of Request Signing keeps secrets outside client code and logs, applies least privilege, prevents replay where needed, monitors anomalies, and separates authentication from authorization.
Overview
How it works
A successful transport result from Request Signing should not be interpreted beyond the exact API state documented by the provider.
What matters in practice
Request signing authenticates the integrity and claimed origin of an API request using a shared secret or asymmetric key. The signed material must be precisely defined: method, path, body bytes or digest, timestamp, nonce and sometimes query parameters. Both parties must canonicalize fields consistently; otherwise valid requests fail verification, or omitted fields remain vulnerable to tampering. Protect signing keys in a secrets manager, apply least privilege, enforce acceptable time skew and reject replayed nonces. TLS is still required because signatures do not encrypt the request body.
Replay controls are often where apparently secure request-signing schemes fail. If a timestamp is signed but the server accepts any age, an intercepted valid request might be usable later. If the signature omits the endpoint or query parameters, an attacker might alter the operation while preserving a valid digest. Verify exactly the agreed canonical bytes and associate signing keys with the least set of API permissions needed for the caller.
Rotating API signing credentials also needs overlap and revocation planning. For a short controlled period, the server may recognize two explicitly identified key versions while clients migrate; after cutover, the old key must stop working. Every verification failure should be logged with request metadata but never include the secret or full authorization signature in an accessible support log.
Related glossary concepts
Example
A merchant signs a payout POST with method, path, SHA-256 body digest, timestamp and nonce. The server verifies the signature before accepting the instruction and rejects a captured request resent with an already-used nonce.
Comparison
Request signing protects an API message. A blockchain transaction signature authorizes chain-specific execution; the keys and verification domains should remain separate.
Key Takeaway
Request signing protects selected data only when canonicalization, key security, replay defense, test vectors, TLS, and rotation are correct.
Sources
- NIST Documentation: Cryptographic Standards And Guidelines — NIST (2026-07-30)
- IETF RFC 9110 — IETF (2026-07-30)
- OpenAPI Initiative Documentation: V3.2.0 — OpenAPI Initiative (2026-07-30)