API Request Signing

A practical example

Example: an integration signs a lead update’s body and timestamp. The receiver verifies the signature, rejects a request outside its allowed time window and records a request identifier to detect replay before accepting the update.

What to evaluate before investing

• Check the documented algorithm and canonical representation of every signed field.
• Test altered bodies, expired timestamps and repeated request identifiers against the receiver.
• Ask how keys are stored, rotated and revoked without unexpectedly interrupting legitimate traffic.

Limitations and tradeoffs

A valid signature does not prove that the data is accurate or that the sender should perform every requested action. Signing does not replace transport encryption, authorization, input validation or explicit replay controls.