Skip to main content

Signing Keys

A signed HTTP message from dilisense carries an x-dilisense-signature header next to its unchanged JSON body. The signature lets you verify that the body originates from dilisense and was not altered on its way to you, for example by a proxy, and it lets you prove later, for example in an audit, what dilisense sent. Verification is optional, clients that ignore the header keep working unchanged.

The header value consists of comma-separated parts: v1,kid=<key id>,sig=<signature>

  • v1: the version of the signature scheme.
  • kid: the ID of the key that created the signature. Use it to fetch the public key from the keys endpoint.
  • sig: the signature, base64url-encoded without padding (RFC 4648 section 5).

Signatures are created with ES256, i.e. ECDSA on the NIST P-256 curve (also known as secp256r1 or prime256v1) with SHA-256 as the hash function. The signed data are the exact UTF-8 bytes of the HTTP body as transmitted.