Signing requests

Each provider has a secret. We sign every call to your MCP server or HTTP API with it.

Create or reset the secret on the Secrets page. Resetting replaces the old value at once.

Every request to your backend includes these headers:

X-BA-Timestamp: time in milliseconds
X-BA-Signature: sha256=<hex>
X-BA-User-Id: the account that used the tool

The signature is HMAC-SHA256 of timestamp + "." + raw body, using your secret as the key. Reject old timestamps and bad signatures.

timestamp="1710000000000"
body='{"name":"lookup","input":"paris"}'
payload="$timestamp.$body"
signature=$(printf '%s' "$payload" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

-sky-300">curl -X -sky-300">POST "$TOOL_URL" \
  -H "Content-Type: application/json" \
  -H "X-BA-Timestamp: $timestamp" \
  -H "X-BA-Signature: sha256=$signature" \
  -H "X-BA-User-Id: $USER_ID" \
  --data "$body"