A backend computes a keyed cryptographic digest over the provider's specified canonical message. The verifier recomputes it and checks equality securely. Distribution Hub's API uses documented signed requests; clients must follow the exact timestamp, body and signature rules rather than inventing their own string format.
Key facts
- Request body and timestamp handling must match documentation
- Never reveal the shared signing secret
- Use the correct hash and signature encoding