For the complete documentation index, see llms.txt. This page is also available as Markdown.
Configure signed requests
How to configure signed requests for Snyk API and Web targets
Configure signed requests to ensure data integrity and authenticity for your API targets in Snyk API & Web.
Signed requests are a security practice used in APIs to ensure the integrity and authenticity of data transmitted between a client and a server. They contain digital fingerprints, often using algorithms like HMAC-SHA256, JSON Web Tokens (JWTs), or custom algorithms, to confirm the sender and prevent attacks by validating specific header fields or the entire request body. This practice is crucial for securing sensitive financial or data operations.
Prerequisites
To configure signed requests, you must have:
change_target_settings permission
Additional requirements:
Signed requests feature enabled for your organization (Contact Snyk Sales)
Configure signed requests
If your target requires requests to be signed, configure the signature in the target Signature settings.
In Snyk, navigate to the Targets page.
Identify the target you want to configure and click the gear icon to access the target settings.
Click the Signature tab and identify the SIGNATURE module.
Select the Signature you want to use and complete the form accordingly.
Click Save.
Verify signed requests
After you save the configuration, signed requests are enabled. The next time you run a scan against this target, Snyk automatically uses the configured signature.
For your security, all sensitive fields (such as certificates and shared secrets) are obfuscated after they are saved and cannot be viewed or retrieved again.
Manage signed requests
You can manage these settings at any time from your target Signature tab:
To temporarily disable a setting, use the Off/On toggle.
To permanently remove a configuration, use the Delete button.
