Security Layers

Every partner request passes through several layers of security. The sequence below shows how keys, tokens, and request signing fit together.

Onboarding

1. The client provides Pipevest with an ED25519 public key.
2. Pipevest provides the client with a client ID and client secret.

Per request

3. The client exchanges the client ID and client secret for a short-lived access token (with a TTL).
4. The client makes an HTTPS request that carries:
   • a Content-Digest hash to maintain request-body integrity, and
   • a Signature over the request’s message components to maintain their integrity.
5. Pipevest parses the HTTPS request and, when signature enforcement is active:
   • rejects any request that fails Content-Digest or Signature verification, and
   • rejects any request that does not originate from the credential’s allowlisted IP address(es).

Signing is optional during onboarding so you can integrate incrementally, and becomes mandatory at go-live — build against the signing flow from the start so the switch is a no-op. The IP allowlist is enforced whenever your credential has one configured.

Future implementation — requests may additionally be made over a VPN.