VaryOnVaryOn Docs
API ReferenceStable v1

Authentication

Tenant-scoped auth headers, signature model, and key lifecycle requirements.

Last updated Mar 4, 2026

Required Headers

POST/v1/*Required

All write endpoints require bearer authentication and explicit tenant context.

Headers

HeaderRequiredDescription
AuthorizationyesBearer <token>
X-Tenant-IdyesTenant scope for access control and audit boundaries.
Content-Typeyesapplication/json for JSON operations.
Authorization: Bearer <token>
X-Tenant-Id: <tenant_id>
Content-Type: application/json

For high-impact operations, add deterministic request signatures.

POST/v1/*Recommended

Use timestamped HMAC signatures to reduce replay and tampering risk.

Signature headers

HeaderRequiredDescription
X-VaryOn-TimestampyesUnix timestamp in seconds.
X-VaryOn-Signatureyessha256=<hmac> over canonical request input.

Canonical input

  1. HTTP method
  2. request path
  3. body hash
  4. tenant id
  5. timestamp
X-VaryOn-Timestamp: 1700000000
X-VaryOn-Signature: sha256=<hmac>

Key Rotation Policy

  1. Provision overlapping active keys.
  2. Run a dual-signing verification window.
  3. Revoke prior key after confirmation.

Enforce least privilege by product surface; do not share keys across tenants.