API request signing

A bearer token in a header proves only that the sender has the token. Anyone who captures it can make any request until it's revoked. Request signing goes further: each request carries a signature over its method, path, body, a timestamp and a nonce (a value used once).

What that gives you:

• Integrity: change any part of the request and the signature fails.
• Freshness: requests older than a short window are refused.
• No replays: a nonce that's been seen is refused, so a captured request can't be sent again.

The cost is a little client code, which SDKs handle for you.

On Valtu

Every API request is signed with your API key: an ECDSA P-256 signature over the method, the path and query, a timestamp in milliseconds, a single-use nonce and the SHA-256 hash of the body, sent with the X-Valtu-Timestamp and X-Valtu-Nonce headers. Each attempt needs a fresh timestamp and nonce, including retries, so a retried request is a new signed request carrying the same externalId (see idempotency). The wallet kit (npm install @valtu/wallet-kit) and the Python SDK (pip install valtu) sign every request and retry reads and idempotent writes safely. The details are in the API guide.