Overview
HTTP signatures are used to secure HTTP messages exchanged between a sender and receiver.
Purpose
Section titled “Purpose”The use of these digital signatures is to address two key aspects of message security:
- Authenticity of any system that requests access to API specific resources
- Integrity of specific message fields to guard against message tampering
Signing is mandatory. Every request to a partner endpoint must carry a Signature, a Signature-Input and — when it has a body — a Content-Digest. A request that is unsigned, or signed with a key that is not registered against your credential, is rejected with 401.
The endpoints this applies to, and the ones it does not, are listed under Which requests must be signed.