Signed Fetch

When protocol clients what to make authenticated HTTPs requests, they can leverage the standard signed fetch mechanism.

A signed fetch is request that includes an authentication chain , represented through headers. Servers with Decentraland-compatible APIs can validate identities before, for example, allowing requests from scenes or creating adapters .

Headers #

The information the server needs to validate the authentication chain is relayed in 3+ headers:

X-Identity-Timestamp: the timestamp field included in the signed payload (see below).
X-Identity-Metadata: the metadata field included in the signed payload (see below).
X-Identity-AuthChain-<index>: the JSON-serialized authentication step <index>, starting from 0.

The transmitted chain is validated by the server as specified .

Body #

The request body is unspecified. Services have full flexibility to use any protocols or formats they like.

Payload #

The authentication chain payload for a signed fetch is a lower-case, colon-separated string that includes some of the request elements:

<method>:<path>:<timestamp>:<metadata>

The method and path fields must match those of the request, and timestamp is the same as in the X-Identity-Timestamp header.

The last field, metadata, can have arbitrary content.

For example:

get:/some/path:1682790056:{"some":"custom json"}