Why Sign API Requests and Responses?#
While HTTPS (TLS) encrypts data in transit and prevents eavesdropping, it primarily ensures confidentiality and basic integrity during the network hop. Adding a signature layer provides additional security guarantees:Integrity: Guarantees that the request or response content has not been tampered with or altered by any intermediary (e.g., proxy, load balancer, malicious actor) between the sender and the receiver.
Authenticity/Non-Repudiation (Sender): For requests, it cryptographically proves that the request genuinely originated from an authorized client and prevents the client from denying they sent a specific request.
Authenticity/Non-Repudiation (Server): For responses, it cryptographically proves that the response genuinely originated from your API server and has not been forged or altered. This is crucial for critical confirmations.
Tamper Detection: Allows immediate detection if any part of the request or response (body or specific headers) has been modified.
Currently Cards will have different signature with other APIs since Cards use different API SpecificationsIn the future, Cards channel will have the same API Specification with other Channels.
