What is Signature Authentication?
Transloadit Signature Authentication uses an Auth Secret to sign Assembly instructions and expiration data. Verification detects altered requests and prevents parties without the secret from authorizing valid submissions.
How Signature Authentication works
A backend canonicalizes the Assembly request data, includes an expiration boundary, and computes a message authentication value with the account secret. Transloadit independently computes the expected value and compares it before accepting the signed instructions. Integrity protection covers the signed fields, while expiration limits how long captured request data remains usable. This mechanism belongs at submission authorization, separate from transport encryption and from permissions on resulting files.
A client authenticates and submits files or references together with workflow instructions. The platform validates the request, schedules dependent operations, records state transitions, and exposes results through a response, polling endpoint, or notification.
Platform concepts become reliable only when their lifecycle is explicit. Authentication, idempotency, retries, timeouts, observability, quotas, and terminal states should be designed together rather than added after failures occur.
Key facts
- 1Only trusted server code should hold the Auth Secret; placing it in browser JavaScript or a mobile binary lets an attacker generate signatures for altered instructions.
- 2The signer and verifier must use identical serialized bytes and field ordering rules, because semantically equivalent JSON can produce a different cryptographic value.
- 3Expiration narrows replay exposure but depends on synchronized clocks; clients should obtain freshly signed data rather than extending or editing a timestamp themselves.
When Signature Authentication matters
Generate signatures on a trusted backend and give clients only the signed request data, never the Auth Secret. Mismatched serialization or expired timestamps cause verification failures even when the intended instructions are valid.
- Running repeatable upload, import, processing, AI, storage, and notification pipelines.
- Tracking long-running media work independently from an application request.
- Applying credentials, quotas, retries, and error policies consistently across integrations.
Working with platform at scale
Guidance that holds across every platform term in this glossary, not just Signature Authentication.
What you gain
- Reusable workflows separate application intent from processing infrastructure.
- Stable job identifiers and lifecycle events improve observability and recovery.
- Managed queues and workers let products scale without embedding every media tool.
What it costs
- Synchronous responses are simple but keep connections open while long work executes.
- Aggressive retries improve recovery from transient faults but can duplicate work or overload a dependency.
- Higher concurrency reduces queue time until resource contention or a downstream limit becomes the bottleneck.
Answer these before production
- 1Define authentication, authorization, idempotency, retries, and terminal error behavior.
- 2Observe queue time, execution time, callbacks, and partial results with stable identifiers.
- 3Exercise malformed, duplicate, interrupted, and unauthorized requests before launch.
How Transloadit helps with Signature Authentication
When Signature Authentication is relevant to your workflow, you can hand the surrounding platform work to Transloadit instead of maintaining the processing stack yourself. Transloadit models file workflows as reusable Assembly Instructions. Upload, import, processing, AI, storage, delivery, status updates, and error handling can be composed without operating the underlying media tools yourself.
Support for a specific codec, container, parameter, or combination can vary by Robot and processing stack. Check the linked documentation for the exact inputs and outputs available for your use case.