Skip to main content
Ask DFlow to cryptographically sign its API responses so you can confirm a response came from DFlow and was not altered in transit. Signatures follow RFC 9421 (HTTP Message Signatures) and use ed25519.
Signing applies only to REST requests, not WebSocket connections.

​
Request a signed response

Add the x-sign-request header to a request:
DFlow signs the response and returns the signature in standard response headers. You can also send an x-request-id header with any string value. It is included in the signed content and echoed back in the response, so you can tie a response to your request and guard against replay. If you omit it, DFlow generates one.
Try it against the developer endpoint (no API key required) and read the response headers:
-D - prints the response headers and -o /dev/null discards the body, so you see signature, signature-input, and content-digest.

​
Response headers

A signed response includes: These headers are exposed via CORS (access-control-expose-headers), so they are readable from the browser. Example:
The signature covers the response @status, content-type, content-digest, and your x-request-id.

​
Public key

DFlow’s base58-encoded public key, carried as the keyid in signature-input:

​
Verify a response

Verify the signature against the public key above using an RFC 9421 library, which handles rebuilding the signature base from the signed components and checking the content-digest.