What is Signature Authentication?
Transloadit Signature Authentication signs the exact JSON params string of an API request, including its auth.expires timestamp, with the Workspace’s Auth Secret. Transloadit verifies the resulting HMAC for integrity and authenticity; it does not encrypt the request. Once the Workspace’s “Require a correct Signature” setting is enabled, requests that arrive unsigned or altered are rejected.
How Signature Authentication works
A backend adds an auth.expires expiration timestamp to the request params, serializes them to JSON once, and computes an HMAC-SHA384 hex digest of that exact string with the Auth Secret, sending the result prefixed with the algorithm name as sha384:. Transloadit computes the same value over the received params string and compares before accepting. There is no canonicalization step: key order may be arbitrary, but signer and verifier must operate on the identical serialization. Enforcement is opt-in per Workspace, and requests authenticated with a valid Bearer token are treated as satisfying Signature Authentication without a signature check.
Key facts
- Only trusted server code should hold the Auth Secret; placing it in browser JavaScript or a mobile binary lets an attacker generate signatures for altered instructions.
- The signature covers the entire serialized
paramsstring, not just the Assembly Instructions. Verification compares exact bytes, so even reserializing the same data with a different key order produces a different value. - Expiration narrows replay exposure but depends on synchronized clocks; clients should obtain freshly signed data rather than extending or editing a timestamp themselves.
When Signature Authentication matters
Generate signatures on a trusted backend and give clients only the signed request data, never the Auth Secret. Enable “Require a correct Signature” in Workspace Settings because computing signatures alone does not make Transloadit reject unsigned requests. The signed string must be byte-for-byte identical to the string sent; reserializing the JSON or letting the timestamp expire causes verification to fail.