Transloadit

What is Signature Authentication?

Transloadit Signature Authentication signs the exact JSON params string of an API request, including its auth.expires timestamp, with the Workspace’s Auth Secret. Transloadit verifies the resulting HMAC for integrity and authenticity; it does not encrypt the request. Once the Workspace’s “Require a correct Signature” setting is enabled, requests that arrive unsigned or altered are rejected.

Request + files
Processing platform
Results + status
A processing platform accepts an authenticated request, executes a workflow, and returns observable results. This diagram shows platform workflows broadly, not specifically Signature Authentication.

How Signature Authentication works

A backend adds an auth.expires expiration timestamp to the request params, serializes them to JSON once, and computes an HMAC-SHA384 hex digest of that exact string with the Auth Secret, sending the result prefixed with the algorithm name as sha384:. Transloadit computes the same value over the received params string and compares before accepting. There is no canonicalization step: key order may be arbitrary, but signer and verifier must operate on the identical serialization. Enforcement is opt-in per Workspace, and requests authenticated with a valid Bearer token are treated as satisfying Signature Authentication without a signature check.

Key facts

  1. Only trusted server code should hold the Auth Secret; placing it in browser JavaScript or a mobile binary lets an attacker generate signatures for altered instructions.
  2. The signature covers the entire serialized params string, not just the Assembly Instructions. Verification compares exact bytes, so even reserializing the same data with a different key order produces a different value.
  3. Expiration narrows replay exposure but depends on synchronized clocks; clients should obtain freshly signed data rather than extending or editing a timestamp themselves.

When Signature Authentication matters

Generate signatures on a trusted backend and give clients only the signed request data, never the Auth Secret. Enable “Require a correct Signature” in Workspace Settings because computing signatures alone does not make Transloadit reject unsigned requests. The signed string must be byte-for-byte identical to the string sent; reserializing the JSON or letting the timestamp expire causes verification to fail.

Common use cases for platform workflows

These examples cover platform workflows broadly, not specifically Signature Authentication.

  • Running repeatable upload, import, processing, AI, storage, and notification pipelines.
  • Tracking long-running media work independently from an application request.
  • Referencing centrally stored credentials by name instead of sending storage secrets with each request.

Working with platform workflows

This guidance covers platform workflows broadly, not just Signature Authentication.

A client authenticates and submits files or references together with workflow instructions. The platform validates the request, schedules dependent operations, records state transitions, and exposes results through a response, polling endpoint, or notification.

Platform concepts become reliable only when their lifecycle is explicit. Authentication, idempotency, retries, timeouts, observability, quotas, and terminal states should be designed together rather than added after failures occur.

What you gain

  • Reusable workflows separate application intent from processing infrastructure.
  • Stable job identifiers and lifecycle events improve observability and recovery.
  • Managed queues and workers let products scale without embedding every media tool.

What it costs

  • Synchronous responses are simple but keep connections open while long work executes.
  • Aggressive retries improve recovery from transient faults but can duplicate work or overload a dependency.
  • Higher concurrency reduces queue time until resource contention or a downstream limit becomes the bottleneck.

Before production

  1. Define authentication, authorization, idempotency, retries, and terminal error behavior.
  2. Observe queue time, execution time, callbacks, and partial results with stable identifiers.
  3. Exercise malformed, duplicate, interrupted, and unauthorized requests before launch.

Turn media knowledge into a working pipeline

Connect uploads, processing, AI, storage, and delivery through one declarative API — with the encoding stack, scaling, and format churn handled for you.

Try Transloadit for free