Signed requests are a security practice used in APIs to ensure the integrity and authenticity of data being transmitted between a client and a server.
They contain digital fingerprints, often using algorithms like HMAC-SHA256, JWTs, or custom ones, to confirm the sender and prevent attacks by validating specific header fields or the entire request body, crucial for securing sensitive financial or data operations.
Prerequisites
You must have the change target settings permission, allowing you to change target settings
You must have Signed Requests enabled with your custom algorithm. To do so, please contact our sales team.
Configure Signed Requests
If your target requires requests to be signed, you can configure that signature in the target's Signature settings.
In Snyk API & Web, navigate to the Targets page.
Identify the target you want to configure, and click on the gear icon to access that target's settings.
Click on the Signature tab and identify the SIGNATURE module.
Select the Signature you want to use and fill out the form accordingly.
Save your changes.
Verify the outcome
After you save the configuration, Signature is enabled. The next time you run a scan against this target, Snyk API & Web automatically uses the configured signature.
Important: For your security, all sensitive fields (like certificates and shared secrets) are obfuscated once saved and cannot be viewed or retrieved again.
Manage the feature
You can manage these settings at any time from your target's Signature tab.
To temporarily disable a setting, use the Off/On toggle.
To permanently remove a configuration, use the Delete button.